From 0c244baec1905178f9103d92a3528fa638f6f58e Mon Sep 17 00:00:00 2001
From: bitWarrior <contact.bitWarrior@proton.me>
Date: Tue, 1 Sep 2026 12:44:15 -0700
Subject: [PATCH] Harden CI permissions and pin actions; add Dependabot config

Supply-chain hardening ahead of open-sourcing.

Workflow permissions are now deny-by-default: `permissions: {}` at the
workflow level, with the test job granting only `contents: read`. The
repository default was already read-only, but stating it in the file means a
later job cannot silently inherit a wider scope.

Actions are pinned to full commit SHAs rather than the `v7` tags. A tag is a
mutable ref; whoever can move it can run arbitrary code in this workflow with
whatever the job holds. Both pins are the current tips of v7.0.1 and v7.0.0
respectively, so this is behaviorally a no-op today. checkout also gets
`persist-credentials: false` so the job token is not left in .git/config for
later steps to reuse.

Pinning to a SHA means an action never receives an upstream security fix on
its own, so .github/dependabot.yml is what makes the pins maintainable: weekly
grouped updates for github-actions, and for pip to cover the optional [tools]
and [dev] extras (the runtime dependency list is empty).

Dependabot alerts and security updates are enabled on the repository. Secret
scanning and push protection are not available on a private repository; they
are free once this goes public and should be turned on at that point.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0114gUUe4CxYr8W8oC95ffmD
---
 .github/dependabot.yml   | 25 +++++++++++++++++++++++++
 .github/workflows/ci.yml | 14 ++++++++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..396139f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,25 @@
+version: 2
+updates:
+  # Actions are SHA-pinned in the workflows, so this is what moves those pins.
+  # Without it, a pinned action never receives a security fix.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # CodeSnake has no runtime dependencies; this covers the optional [tools]
+  # and [dev] extras in pyproject.toml.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "deps"
+    groups:
+      tools:
+        patterns: ["*"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b065452..43f4706 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,16 +5,26 @@ on:
     branches: [main]
   pull_request:
 
+# Deny by default; each job grants only what it needs.
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      # Actions are pinned to a commit SHA: a tag is a mutable ref, and whoever
+      # can move it can run arbitrary code in this workflow.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # Do not leave the job token in .git/config for later steps to reuse.
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install