Harden CI/security: CodeQL + Dependabot + coverage gate + SECURITY (pilot)#1

Merged

Jott2121 merged 3 commits into

mainfrom

harden/ci-security

Jun 17, 2026

Commits on Jun 17, 2026

ci: add CodeQL + Dependabot + coverage gate + SECURITY policy; pin actions to SHAs

Jott2121
and
claude
committed
fix(ci): set coverage relative_files so the coverage-comment action resolves paths

Jott2121
and
claude
committed
test+ci: cover get_gate error path (97%); pin publish.yml actions to SHAs

Jott2121
and
claude
committed