fix(alpha.7): harden trust boundaries and DSD baseline

Author: DevBot

.github/actions/setup-deno-workspace/action.yml

@@ -4,11 +4,13 @@ description: Install Deno, restore workspace dependencies, and materialize node_
 runs:
   using: composite
   steps:
-    - uses: denoland/setup-deno@v2
+    # v2.0.5
+    - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
       with:
         deno-version-file: .dvmrc
     - name: Cache dependencies
-      uses: actions/cache@v4
+      # v4.2.3
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
       with:
         path: node_modules
         key: ${{ runner.os }}-deno-${{ hashFiles('.dvmrc') }}-${{ hashFiles('deno.lock') }}

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/autoflow-ci.yml

@@ -20,7 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
       - uses: ./.github/actions/setup-deno-workspace
       - name: Install Playwright browsers
         run: ./node_modules/.bin/playwright install --with-deps chromium

.github/workflows/autoflow-release.yml

@@ -32,13 +32,15 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           ref: main
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
       - uses: ./.github/actions/setup-deno-workspace
-      - uses: actions/setup-node@v4
+      # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/codeql.yml

@@ -34,17 +34,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        # v4.2.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        # v3.28.17
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
         with:
           languages: ${{ matrix.language }}
           # Deno project -?no build step needed for TS source analysis
           # CodeQL JS/TS extractor works on raw source files
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        # v3.28.17
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/nightly-stress.yml

@@ -13,8 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     steps:
-      - uses: actions/checkout@v4
-      - uses: denoland/setup-deno@v2
+      # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      # v2.0.5
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed
         with:
           deno-version: v2.x
       - name: Run representative 30-minute workload
@@ -26,7 +28,8 @@ jobs:
         run: deno task stress:dogfood
       - name: Archive stress evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        # v4.6.2
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: mastodon-desktop-stress-report
           path: examples/deno-desktop-mastodon/stress-report.json

.github/workflows/opencode-review.yml

@@ -12,7 +12,8 @@ jobs:
       pull-requests: write
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      # v4.2.2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           persist-credentials: false
 

CODE_OF_CONDUCT.md

@@ -0,0 +1,11 @@
+# Code of Conduct
+
+We expect contributors and maintainers to be respectful, constructive, and
+inclusive. Harassment, personal attacks, discrimination, and sharing private
+information without consent are not acceptable.
+
+Report a conduct concern privately through
+[GitHub private vulnerability reporting](https://github.com/open-element/openelement/security/advisories/new)
+with the subject `Conduct concern`. Maintainers will acknowledge receipt within
+five business days, protect confidentiality where possible, and choose an
+appropriate response, from guidance to removal from project spaces.

CONTRIBUTING.md

@@ -2,6 +2,11 @@
 
 Read first: `docs/governance/PROJECT_WORKFLOW.md`.
 
+Before opening a contribution, read [SECURITY.md](./SECURITY.md),
+[CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md), [SUPPORT.md](./SUPPORT.md), and
+[MAINTAINERS.md](./MAINTAINERS.md). They define private reports, community
+expectations, support routing, and review ownership.
+
 openElement uses AutoWorkflow for project management. A change should identify
 the version SOP, ADR impact, NextVersion package, implementation evidence, and
 release-document impact before it is merged.

MAINTAINERS.md

@@ -0,0 +1,10 @@
+# Maintainer ownership
+
+Repository maintainers with write access own triage, review, merge, release,
+and security-response decisions. A change with architecture, public API,
+security, release, or dependency-policy impact requires maintainer approval
+under [the project workflow](./docs/governance/PROJECT_WORKFLOW.md).
+
+The author of a pull request may not be its only approving reviewer. If no
+maintainer is available, leave the pull request open rather than bypassing the
+required review or release gates.