To prevent issues from using GitHub actions and dependabot, I hardened
the workflows using [zizmor](https://docs.zizmor.sh/). There are still
77 open findings. I only applied the ones that are easy wins.
- Pin actions to a commit hash instead of tag - tags are not immutable
(see [`unpinned-uses`](https://docs.zizmor.sh/audits/#unpinned-uses))
- Disable `persist-credentials` on checkout - we don't need it (see
[`artipacked`](https://docs.zizmor.sh/audits/#artipacked))
- Set cooldown on dependabot updates (see
[`dependabot-cooldown`](https://docs.zizmor.sh/audits/#dependabot-cooldown)).
For our own packages, we can manually create PRs.
I left the docker images unpinned, because they're frequently updated,
but zizmor would like to see them pinned as well.
Reviewed-by: pajlada <rasmus.karlsson@pajlada.com>
This PR aims to add very basic REUSE license checking
https://reuse.software.
My intention is not to sort out all errors in this PR, but instead sort
that out over multiple incrementals PR going forward in an undisruptive
way as possible.
Nerixyz
dependabot[bot]
pajlada