[Nerdy-Technician]

Same security setup as Nerdy-Technician and Nerdy-RMMScripts.

Summary

• Security workflow (security.yml): actionlint (shellcheck at warning level), gitleaks secret scan of the full history, and dependency review on PRs
• Dependabot auto-merge: Dependabot PRs are queued with GitHub auto-merge and squash-merged once every required check passes
• CodeQL (security-extended) on PRs, main and weekly; OpenSSF Scorecard on main and weekly
• Pinned dependencies: every action is pinned to a commit SHA with its version as a comment. Dependabot keeps them updated.
• Dependabot: updates are grouped (npm: minor and patch together) to cut down on PR noise
• SECURITY.md pointing to private vulnerability reporting

Testing

• actionlint passes locally on all workflows
• gitleaks: no leaks found in the full history

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.