[Nerdy-Technician]

Same setup as the Nerdy-Technician site repo.

Summary

• More CI checks next to ShellCheck and PSScriptAnalyzer: actionlint, dependency review on PRs, and a gitleaks secret scan of the full history
• CodeQL for the workflow files (security-extended) on PRs, pushes to main and weekly
• OpenSSF Scorecard on main and weekly, with results in the Security tab
• Pinned dependencies: every action is pinned to a commit SHA with its version as a comment, and the gitleaks image is pinned by digest
• Release workflow hardening: tag and version values now go through env: instead of being pasted into shell scripts, and contents: write is limited to the job that needs it
• Dependabot: removed the pip entry (the repo has no Python), and Actions updates are grouped
• Auto-merge: Dependabot PRs are squash-merged once every CI check passes. This doesn't trigger a release, because merges made with GITHUB_TOKEN don't fire the push-to-main release workflow.
• Adds SECURITY.md (private vulnerability reporting) and an MIT LICENSE

Testing

• actionlint passes on all workflows locally
• gitleaks: 90 commits scanned, no leaks

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.