[andife]

Description

Hardens the supply chain security of the repository's GitHub Actions workflows, following OpenSSF/GitHub security hardening guidance:

• Pin all GitHub Actions to full commit SHAs (with version comments, e.g. actions/checkout@11d5960a… # v4.4.0). Mutable tags can be rewritten to point at malicious commits (as happened in the tj-actions/changed-files compromise); commit SHAs are immutable. All pins stay within the currently used major versions, so no behavior changes.
• Add least-privilege permissions blocks to every workflow. All workflows now default to contents: read; the changelog-enforcer additionally gets pull-requests: read (needed to list PR files), and the pypi deploy job gets contents: write (needed by ncipollo/release-action to create the GitHub release).
• Set persist-credentials: false on every actions/checkout that does not need push credentials. The docs-target checkout keeps its SSH deploy key, which ghp-import --push requires.
• Add a Dependabot config (.github/dependabot.yml) with weekly, grouped updates for GitHub Actions (Dependabot also bumps pinned SHAs and keeps the version comments in sync) and weekly updates for pip (covers the exactly-pinned docs extra in pyproject.toml).
• Add the OpenSSF Scorecard workflow, running weekly and on pushes to master, uploading SARIF results to the code scanning dashboard and publishing results to the OpenSSF API (enables the Scorecard badge).

Validation: all workflow files and the Dependabot config were checked with a YAML parser (yaml.safe_load) — all parse successfully. These are CI-configuration-only changes, so the Python test suite is unaffected; no changes were made under markdown/, so no changelog entry is required per the changelog-enforcer rules.

A follow-up PR migrates PyPI publishing to Trusted Publishing (OIDC), kept separate because it requires maintainer configuration on PyPI.

AI Assistance Disclosure

• No AI tools were used in preparing this PR.

• AI tools were used and I have disclosed which ones, and have fully reviewed and verified their output.

  AI tools were use to assist with the following:

  • Code
  • Code Comments
  • Documentation
  • Changelog Entry
  • Commit Message
  • The Description Above
  • Other: GitHub Copilot CLI (workflow/CI configuration changes)

Checklist

• This PR follows the contribution guidelines.
• The code follows the Code Style Guide.
• The commit message follows the Commit Message Style Guide.
• I have added or updated relevant docs, including release notes if applicable which follow the Documentation Style Guide. (Not applicable: CI-configuration-only change, no user-facing behavior change.)
• I have added or updated relevant tests. (Not applicable: no Python code changed; workflows validated via YAML parsing.)
• I have not requested, and will not request, an automated AI review for this PR.

[waylan]

You assert that these are recommended best practices, but I am suspect of AI generated assertions. Can you provide links to the documentation for each assertion?

[waylan]

We intentionally have all code-scanning automations turned off for this project. I am not interested in getting updates from an automated tool and will be annoyed by them and ignore them. This will not be accepted so long as such tools are being utilized.