ci: harden GitHub Actions supply-chain and repo security

Supply-chain (H3):
- Pin actions/checkout to SHA 34e11487 (v4.3.1) in all three workflows
- Pin github/codeql-action/init and /analyze to SHA 5c8a8a64 (v3.35.1)

Dependency scanning (H2):
- Add .github/dependabot.yml — weekly updates for github-actions and
  composer ecosystems; will open PRs to bump pinned SHAs automatically

CodeQL SAST (M4):
- Add .github/workflows/codeql.yml — PHP analysis with security-extended
  query suite on push/PR to main and weekly schedule

Release gate (M1):
- Add 'release' environment to release.yml job; environment configured
  with required reviewer (geekmuse) via GitHub API so every tag-triggered
  release requires manual approval before the job runs

Security policy (M3):
- Add SECURITY.md with supported versions, private disclosure email,
  and response SLA

Author: geekmuse

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+
+updates:
+  # Keep GitHub Actions pinned SHAs up to date.
+  # Dependabot will open PRs to bump the SHA comments and the hash itself
+  # whenever a new release of a used action is published.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(ci)"
+
+  # Keep Composer dev dependencies (phpunit, phpstan) up to date.
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
 
       # Stage 1 — PHP syntax check
       # Uses kanboard/kanboard image with entrypoint override (default entrypoint

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Weekly scan every Monday at 03:00 UTC, independent of push activity.
+    - cron: '0 3 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (PHP)
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@5c8a8a642e79153f5d047b10ec1cba1d1cc65699  # v3.35.1
+        with:
+          languages: php
+          # Use the security-extended suite for broader PHP vulnerability coverage
+          # (SQL injection, path traversal, XSS, SSRF, etc.)
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@5c8a8a642e79153f5d047b10ec1cba1d1cc65699  # v3.35.1
+        with:
+          category: "/language:php"

.github/workflows/release.yml

@@ -9,12 +9,13 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: release
     permissions:
       contents: write
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
 
       - name: Extract version from tag
         id: version

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.2.x   | ✅ Yes    |
+| < 0.2   | ❌ No     |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+To report a vulnerability, email:
+**oss-projects+kanboard@bradleyscampbell.net**
+
+Include as much detail as possible:
+- Plugin version affected
+- Kanboard version and PHP version
+- Description of the vulnerability and potential impact
+- Steps to reproduce (proof-of-concept if available)
+
+You can expect an acknowledgement within **72 hours** and a resolution
+or status update within **14 days**.
+
+If a fix is warranted, a patched release will be published and the reporter
+credited in the `CHANGELOG.md` (unless anonymity is requested).