From 875b98d42db86d734b10e75308a7ce6ab20e9c64 Mon Sep 17 00:00:00 2001
From: "stepsecurity-app[bot]"
 <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Date: Tue, 5 May 2026 16:57:22 +0000
Subject: [PATCH] [StepSecurity] Apply security best practices

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
---
 .devcontainer/Dockerfile                 |  2 +-
 .github/dependabot.yml                   | 43 ++++++++++++++++++++++++
 .github/workflows/notify-parent-repo.yml |  5 +++
 3 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 74c6ffc..7a0dcd5 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/base:bookworm
+FROM mcr.microsoft.com/devcontainers/base:bookworm@sha256:17e6cc517b483d1108b333d4c34352b0a21617f0117052e9b259d47113a9dc37
 RUN apt-get update && \
     export DEBIAN_FRONTEND=noninteractive && \
     apt-get -y install \
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c14b2ac
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,43 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /.devcontainer
+    schedule:
+      interval: daily
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
diff --git a/.github/workflows/notify-parent-repo.yml b/.github/workflows/notify-parent-repo.yml
index dec3bca..9aacb17 100644
--- a/.github/workflows/notify-parent-repo.yml
+++ b/.github/workflows/notify-parent-repo.yml
@@ -6,8 +6,13 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update:
+    permissions:
+      contents: write  # for Git to git push
     if: github.repository == 'euc-dev/ws1-sdk-uem-android'
     runs-on: ubuntu-latest