Nerdy-Technician · Sep 30, 2026 · Sep 30, 2026 · Sep 30, 2026
@@ -1,19 +1,12 @@
 version: 2
 updates:
-  - package-ecosystem: "pip"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 5
-    allow:
-      - dependency-type: "direct"
-    labels:
-      - "deps"
-      - "security"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
     labels:
       - "actions"
-      - "security"
+      - "security"
+    groups:
+      actions:
+        patterns: ["*"]
@@ -4,6 +4,7 @@ on:
   pull_request:
   push:
     branches: [main]
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -26,7 +27,7 @@ jobs:
         Linux/Monitoring/Check - Wazuh_is_running.sh
         Linux/Network/Network - Port Scan.sh
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: ShellCheck (errors only)
         run: |
           shellcheck --version
@@ -45,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Analyze PowerShell scripts
         shell: pwsh
         run: |
@@ -70,3 +71,52 @@ jobs:
           }
           Write-Output "Analyzed $($files.Count) PowerShell files, $failed error(s)."
           if ($failed -gt 0) { exit 1 }
+
+  actionlint:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Run actionlint
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
+
+  dependency-review:
+    name: Dependency review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: high
+
+  secret-scan:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks
+        run: |
+          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f git /repo --redact --no-banner
+
+  # Merges Dependabot PRs once every check above has passed.
+  dependabot-automerge:
+    name: Auto-merge Dependabot
+    needs: [shellcheck, powershell, actionlint, dependency-review, secret-scan]
+    if: github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      GH_REPO: ${{ github.repository }}
+      PR_URL: ${{ github.event.pull_request.html_url }}
+    steps:
+      - name: Squash-merge PR
+        run: gh pr merge "$PR_URL" --squash --delete-branch
@@ -0,0 +1,31 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (actions)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          languages: actions
+          queries: security-extended
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          category: /language:actions
@@ -19,7 +19,7 @@ on:
         default: 'false'
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   WINDOWS_ARCHIVE: Nerdy-RMMScripts-Windows.zip
@@ -28,17 +28,21 @@ env:
 jobs:
   build-and-package:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout repository (full history)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Debug event context
+        env:
+          TAG_INPUT: ${{ inputs.tag }}
         run: |
-          echo "Event: ${{ github.event_name }}"
-          echo "Ref: ${{ github.ref }}"
-          echo "Tag Input: ${{ inputs.tag }}"
+          echo "Event: $GITHUB_EVENT_NAME"
+          echo "Ref: $GITHUB_REF"
+          echo "Tag Input: $TAG_INPUT"
           git tag --list --sort=-creatordate | head -n 15
           echo "Commit message:" && git log -1 --pretty=%B
 
@@ -57,54 +61,61 @@ jobs:
             PREV_TAG="$t"; break
           done
           echo "Previous tag: $PREV_TAG"
-          echo "current_tag=$CURRENT_TAG" >> $GITHUB_OUTPUT
-          echo "previous_tag=$PREV_TAG" >> $GITHUB_OUTPUT
+          echo "current_tag=$CURRENT_TAG" >> "$GITHUB_OUTPUT"
+          echo "previous_tag=$PREV_TAG" >> "$GITHUB_OUTPUT"
 
       - name: Run Windows packaging script (PowerShell Core)
         shell: pwsh
+        env:
+          PREV_TAG: ${{ steps.tags.outputs.previous_tag }}
         run: |
-          $prev = '${{ steps.tags.outputs.previous_tag }}'
+          $prev = $env:PREV_TAG
           if ($prev) { ./release/Create-Windows-Release.ps1 -PreviousTag $prev } else { ./release/Create-Windows-Release.ps1 }
 
       - name: Make Linux script executable
         run: chmod +x release/create-linux-release.sh
 
       - name: Run Linux packaging script
+        env:
+          PREV_TAG: ${{ steps.tags.outputs.previous_tag }}
         run: |
-          prev='${{ steps.tags.outputs.previous_tag }}'
+          prev="$PREV_TAG"
           if [ -n "$prev" ]; then ./release/create-linux-release.sh -p "$prev"; else ./release/create-linux-release.sh; fi
 
       - name: Compute checksums & JSON manifest
+        env:
+          CURRENT_TAG: ${{ steps.tags.outputs.current_tag }}
+          PREV_TAG: ${{ steps.tags.outputs.previous_tag }}
         run: |
           cd release
           echo "Generating SHA256SUMS.txt"
           rm -f SHA256SUMS.txt
           for f in Nerdy-RMMScripts-Windows.zip Nerdy-RMMScripts-Linux.zip ReleaseNotes-*.md; do
             if [ -f "$f" ]; then sha256sum "$f" >> SHA256SUMS.txt; fi
           done
-          echo '{"generated":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","tag":"'${{ steps.tags.outputs.current_tag }}'","previous":"'${{ steps.tags.outputs.previous_tag }}'","archives":[' > manifest.json
+          echo '{"generated":"'"$(date -u +%Y-%m-%dT%H:%M:%SZ)"'","tag":"'"$CURRENT_TAG"'","previous":"'"$PREV_TAG"'","archives":[' > manifest.json
           first=1
           for a in Nerdy-RMMScripts-Windows.zip Nerdy-RMMScripts-Linux.zip; do
             if [ -f "$a" ]; then
               size=$(stat -c %s "$a")
-              if [ $first -eq 0 ]; then echo ',' >> manifest.json; fi
-              echo '{"name":"'$a'","size":'$size'}' >> manifest.json
+              if [ "$first" -eq 0 ]; then echo ',' >> manifest.json; fi
+              echo '{"name":"'"$a"'","size":'"$size"'}' >> manifest.json
               first=0
             fi
           done
           echo '],"notes":[' >> manifest.json
           first=1
           for n in ReleaseNotes-*.md; do
             size=$(stat -c %s "$n")
-            if [ $first -eq 0 ]; then echo ',' >> manifest.json; fi
-            echo '{"name":"'$n'","size":'$size'}' >> manifest.json
+            if [ "$first" -eq 0 ]; then echo ',' >> manifest.json; fi
+            echo '{"name":"'"$n"'","size":'"$size"'}' >> manifest.json
             first=0
           done
           echo ']}' >> manifest.json
           echo "Manifest:" && cat manifest.json
 
       - name: Upload artifacts (always)
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: packaged-scripts
           path: |
@@ -121,7 +132,7 @@ jobs:
         run: |
           COMMIT_MSG=$(git log -1 --pretty=%B)
           if echo "$COMMIT_MSG" | grep -qi '\[skip release\]'; then
-            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "skip=true" >> "$GITHUB_OUTPUT"
             echo "Release skipped by commit message directive.";
             exit 0
           fi
@@ -130,39 +141,42 @@ jobs:
             NEW_TAG="v0.1.0"
           else
             LATEST=$(echo "$TAGS" | sort -V | tail -n1)
-            MAJOR=$(echo $LATEST | sed -E 's/v([0-9]+)\.[0-9]+\.[0-9]+/\1/')
-            MINOR=$(echo $LATEST | sed -E 's/v[0-9]+\.([0-9]+)\.[0-9]+/\1/')
-            PATCH=$(echo $LATEST | sed -E 's/v[0-9]+\.[0-9]+\.([0-9]+)/\1/')
+            MAJOR=$(echo "$LATEST" | sed -E 's/v([0-9]+)\.[0-9]+\.[0-9]+/\1/')
+            MINOR=$(echo "$LATEST" | sed -E 's/v[0-9]+\.([0-9]+)\.[0-9]+/\1/')
+            PATCH=$(echo "$LATEST" | sed -E 's/v[0-9]+\.[0-9]+\.([0-9]+)/\1/')
             PATCH=$((PATCH+1))
             NEW_TAG="v${MAJOR}.${MINOR}.${PATCH}"
           fi
           echo "Computed next tag: $NEW_TAG"
-          echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT
+          echo "new_tag=$NEW_TAG" >> "$GITHUB_OUTPUT"
           git tag "$NEW_TAG"
           git push origin "$NEW_TAG"
 
       - name: Build changes markdown
         id: changes
+        env:
+          PREV: ${{ steps.tags.outputs.previous_tag }}
+          CUR: ${{ steps.version.outputs.new_tag || steps.tags.outputs.current_tag }}
         run: |
-          PREV='${{ steps.tags.outputs.previous_tag }}'
-          CUR='${{ steps.version.outputs.new_tag || steps.tags.outputs.current_tag }}'
           if [ -n "$PREV" ]; then
           TABLE=$(git diff --name-status "$PREV" "$CUR" | awk 'BEGIN{print "| Status | File |"; print "|--------|------|";} {s=$1; f=$2; if(s=="R"){f=$3} emoji=""; if(s=="A")emoji="🆕"; else if(s=="M")emoji="✏️"; else if(s=="D")emoji="🗑️"; else if(s=="R")emoji="♻️"; else if(s=="C")emoji="📄"; print "| " emoji " " s " | " f " |"}')
             COUNTS=$(git diff --name-status "$PREV" "$CUR" | awk '{c[$1]++} END{for(k in c){emoji=""; if(k=="A")emoji="🆕"; else if(k=="M")emoji="✏️"; else if(k=="D")emoji="🗑️"; else if(k=="R")emoji="♻️"; else if(k=="C")emoji="📄"; print "- " emoji " " k ":" c[k]}}')
-            echo "table<<EOF" >> $GITHUB_OUTPUT
-            echo "$TABLE" >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
-            echo "counts<<EOF" >> $GITHUB_OUTPUT
-            echo "$COUNTS" >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
-            echo "initial=false" >> $GITHUB_OUTPUT
+            {
+              echo "table<<EOF"
+              echo "$TABLE"
+              echo "EOF"
+              echo "counts<<EOF"
+              echo "$COUNTS"
+              echo "EOF"
+              echo "initial=false"
+            } >> "$GITHUB_OUTPUT"
           else
-            echo "initial=true" >> $GITHUB_OUTPUT
+            echo "initial=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Auto create release from push
         if: steps.version.outputs.skip != 'true' && steps.version.outputs.new_tag && github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ steps.version.outputs.new_tag }}
           name: ${{ steps.version.outputs.new_tag }}
@@ -190,7 +204,7 @@ jobs:
 
       - name: Attach assets to release
         if: github.event_name == 'release' && github.event.inputs.dryRun != 'true'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: |
             release/${{ env.WINDOWS_ARCHIVE }}

@@ -7,9 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
-  actions: read
-  packages: read
+  contents: read
 
 concurrency:
   group: release-descriptor
@@ -18,9 +16,11 @@ concurrency:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -43,19 +43,21 @@ jobs:
 
       - name: Build archives + diff
         if: steps.version.outputs.skip != 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
           mkdir -p release_out
           zip -r release_out/Nerdy-RMMScripts-Windows.zip Windows -x "*/.git/*"
           zip -r release_out/Nerdy-RMMScripts-Linux.zip Linux -x "*/.git/*"
-          PREV="$(git tag --sort=-creatordate | grep -v "^${{ steps.version.outputs.version }}$" | grep '^v' | head -1 || true)"
+          PREV="$(git tag --sort=-creatordate | grep -v "^${VERSION}$" | grep '^v' | head -1 || true)"
           if [ -n "${PREV}" ]; then git diff --name-status "${PREV}"...HEAD > release_out/diff.txt; else git diff --name-status HEAD > release_out/diff.txt; fi
-          A=$(grep '^A' release_out/diff.txt | wc -l | tr -d ' ' || true)
-          M=$(grep '^M' release_out/diff.txt | wc -l | tr -d ' ' || true)
-          D=$(grep '^D' release_out/diff.txt | wc -l | tr -d ' ' || true)
-          R=$(grep '^R' release_out/diff.txt | wc -l | tr -d ' ' || true)
+          A=$(grep -c '^A' release_out/diff.txt || true)
+          M=$(grep -c '^M' release_out/diff.txt || true)
+          D=$(grep -c '^D' release_out/diff.txt || true)
+          R=$(grep -c '^R' release_out/diff.txt || true)
           {
-            echo "## 🚀 Release ${{ steps.version.outputs.version }}"
+            echo "## 🚀 Release ${VERSION}"
             [ -n "${PREV}" ] && echo "Previous Tag: ${PREV}" || echo "Initial Release"
             echo
             echo "### 📊 Changes"
@@ -78,16 +80,18 @@ jobs:
 
       - name: Create tag
         if: steps.version.outputs.skip != 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git tag "${{ steps.version.outputs.version }}"
-          git push origin "${{ steps.version.outputs.version }}"
+          git tag "${VERSION}"
+          git push origin "${VERSION}"
 
       - name: Publish release
         if: steps.version.outputs.skip != 'true'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ steps.version.outputs.version }}
           name: ${{ steps.version.outputs.version }}