fix: apply security best practices

[step-security-bot]

Summary

This pull request is created by StepSecurity at the request of @jescalada. Please merge the Pull Request to incorporate the requested changes. Please tag @jescalada on your message if you have any questions related to the PR.

Security Fixes

Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access. See how popular open-source projects use Harden-Runner here.

Harden runner usage

You can find link to view insights and policy recommendation in the build log

Please refer to documentation to find more details.

Keeping your actions up to date with Dependabot

With Dependabot version updates, when Dependabot identifies an outdated dependency, it raises a pull request to update the manifest to the latest version of the dependency. This is recommended by GitHub as well as The Open Source Security Foundation (OpenSSF).

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Maintain Code Quality with Pre-Commit

Pre-commit is a framework for managing and maintaining multi-language pre-commit hooks. Hooks can be any scripts, code, or binaries that run at any stage of the git workflow. Pre-commit hooks are useful for enforcing code quality, code formatting, and detecting security vulnerabilities.

• Official Pre-commit documentation
• Getting Started guide

Feedback

For bug reports, feature requests, and general feedback; please email support@stepsecurity.io. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io

[netlify]

✅ Deploy Preview for endearing-brigadeiros-63f9d0 canceled.

Name	Link
🔨 Latest commit	6b9cd88
🔍 Latest deploy log	https://app.netlify.com/projects/endearing-brigadeiros-63f9d0/deploys/6a237d74d25c4100072b2297

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.68%. Comparing base (84a1a8c) to head (6b9cd88).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1548   +/-   ##
=======================================
  Coverage   90.68%   90.68%           
=======================================
  Files          69       69           
  Lines        5741     5741           
  Branches      989      989           
=======================================
  Hits         5206     5206           
  Misses        517      517           
  Partials       18       18           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kriswest]

If we're using renovate do we want or need dependabot?

Other changes all LGTM

[jescalada]

@kriswest I just ported the useful parts of renovate.json to dependabot.yml and set it to run weekly. Ready for a final look! 🙏🏼

[kriswest]

Claude had a few comments on the dependabot config (after feeding it the latest options document for dependabot). See below for the review comments, of them I think the following are worth applying:

• Cooldown (@06kellyjac suggested at #1552)
• Major update grouping
• versioning-strategy: increase is too aggressive
• directory vs directories inconsistency

Suggestions added for these

---

Cooldown

cooldown is natively supported by Dependabot and should be added. npm supports full semver granularity (semver-patch-days, semver-minor-days, semver-major-days). GitHub Actions and Docker only support default-days. Cooldown applies to version updates only — security updates are unaffected, which is the correct behaviour.

Major npm updates have no group

The npm-non-major group only covers minor and patch. Major version updates will fall through and create individual ungrouped PRs, which can be noisy. A separate npm-major group should be added, or major updates explicitly handled.

versioning-strategy: increase is too aggressive

With increase, Dependabot will always bump the lower bound of the version constraint in package.json, even when the existing ^ range already satisfies the new version. Given that virtually all dependencies in this project use ^ ranges, increase-if-necessary is the safer choice — it only modifies the constraint when the new version falls outside the existing range.

directory vs directories inconsistency

The github-actions block uses the singular directory: '/' while all other ecosystems use the plural directories. Both are valid but inconsistent. Since the docs confirm directories supports glob wildcards and directory does not, standardising on directories throughout is preferable.

No open-pull-requests-limit set

The default is 5 per ecosystem. With npm covering 5 directories and no limit set, grouped PRs plus ungrouped major PRs could hit the cap and silently stop further updates. Setting an explicit limit avoids surprises.

No labels defined

Without labels, PRs only get Dependabot's default dependencies label. Adding a custom label such as automated makes it easy to filter and triage the PR queue, especially for a project with multiple maintainers.

schedule.day not set

Weekly schedules default to Monday. For a project with active contributors, staggering ecosystems across different days (e.g. Actions on Monday, Docker on Tuesday, npm on Wednesday) prevents a flood of PRs arriving simultaneously at the start of the week.

[jescalada]

@kriswest Ready to merge!

[kriswest]

LGTM