Use a specific number of spaces instead of the default of only caring
if the number of spaces used is consistent within a file. Ensure that
block sequences inside of mappings are indented.

The use of flow sequences and mappings is not as readable as block
collections and so should be discouraged. Since it is a cleaner
representation for empty collections we will allow those, but if an
application otherwise requires flow collections they can be explicitly
enabled by disabling the checks per
https://yamllint.readthedocs.io/en/stable/disable_with_comments.html

When running ansible-lint it will throw the following warning with our
current configuration:
WARNING  Found incompatible custom yamllint configuration (.yamllint), please either remove the file or edit it to comply with:
  - comments.min-spaces-from-content must be 1
  - braces.max-spaces-inside must be 1
  - octal-values.forbid-implicit-octal must be true
  - octal-values.forbid-explicit-octal must be true.
Thus we implement these configuration rules.

Previously we disabled the `truthy` rule due to Ansible's use of
`yes`/`no` for boolean values. That is no longer the case and the
default configuration used by ansible-lint now has this rule enabled.
The use of `on` as a key in GitHub Actions workflow syntax means we
needed to add disable-line comments for the truthy rule.

Add a configuration for the `quoted-strings` rule that matches our best
practices. Other files are updated to comply with these new settings.

Also add semver as a dev requirement.

I'd like to start versioning descendants of skeleton-ansible-role (in
anticipation of pinning Ansible role versions at a future date), and I
thought it would make sense to go ahead and implement this at the
skeleton-generic level to force us to start versioning all
repositories.

Repositories that already version can ignore these changes when they
flow down via Lineage, since they will already have their own version
files and version-bumping script.

This is done automatically with the `pre-commit autoupdate` command.

…n-comment

Fix spelling error in comment

Update our yamllint configuration file

This new action simply applies our standard permissions monitoring and
runner hardening.  Using it allows us to DRY out the GH Actions
workflows in our skeleton repositories a bit.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

GitHubSecurityLab/actions-permissions and step-security/harden-runner
are no longer direct dependencies since we are now using
cisagov/action-job-preamble.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Flesh out the comment a little so its meaning is clearer.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Make sure to mention that the permissions monitoring config can be
changed by creating a repo-level variable; there is no need to modify
the workflow.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

…preamble

This action supports this functionality now, so we may as well take
advantage of it.

Also disable GH permissions monitoring, since that functionality is
poorly implemented and has been causing a lot of problems due to the
MITM implementation hogging or leaking memory.

Apply our standard job preamble via cisagov/action-job-preamble

CodeQL now supports GitHub Actions as a language, so it makes sense to
add such a workflow to this repository.

See this link for more details:
https://github.blog/changelog/2024-12-17-find-and-fix-actions-workflows-vulnerabilities-with-codeql-public-preview/

Also correctly sort YAML keys.

Co-authored-by: Nick <50747025+mcdonnnj@users.noreply.github.com>

This aligns with the changes in cisagov/skeleton-generic#201.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Children of this skeleton repository will require this Dependabot
ignore directive.

Use cisagov/action-job-preamble instead of
crazy-max/ghaction-github-status and crazy-max/ghaction-dump-context
directly.

This action reviews dependency changes for vulnerabilities and license
changes.

This aligns with the changes in cisagov/skeleton-generic#201.

Co-authored-by: Nick M <50747025+mcdonnnj@users.noreply.github.com>

Fix typo