[davidberenstein1957]

What and why

The branch ruleset on main requires a status check named default, but no workflow in this repository reports it, so every merge has needed an admin bypass. verify-skills.yml already runs the right checks as a job named verify, but its paths: filter skips it on pull requests that touch other files, and GitHub leaves a skipped required check pending. This PR removes that filter so verify runs on every pull request, and the ruleset should require verify instead of default.

verify job

• make verify
• ./.maintainer/validate_release.sh --skip-verify

Both steps take seconds, so the job runs on every pull request instead of filtering by path. The PR also adds permissions: contents: read and pins actions/checkout and actions/setup-node to full commit SHAs, with the version in a trailing comment.

Dependabot

.github/dependabot.yml runs weekly, groups minor and patch updates into one PR, and caps open pull requests at 50. Dependabot PRs get no Actions secrets, and the verify job uses none.

• github-actions: /

Hardening

• The Dependabot docker entry for /.github/workflows is removed. No workflow here uses a container image now that Semgrep has moved out.
• release-skills.yml gets a top-level permissions: contents: read. The release job keeps its own contents: write.

Semgrep

This PR no longer adds a Semgrep job. Semgrep runs from .github/workflows/semgrep.yml in PrunaAI/.github (PrunaAI/.github#1), which an org ruleset will require on every repository's default branch.

Before merging

Change the required status check in this repository's ruleset from default to verify first. Until then this PR fails its own required check. The org and repo rule changes are tracked in PrunaAI/prunatree#639.

Testing

• dependabot.yml validated with check-jsonschema --builtin-schema vendor.dependabot.
• verify-skills.yml checked with actionlint.

Commits

• ddfe532 ci: add default status check and Dependabot config
• b01f9d0 ci: pin actions in default workflow to commit SHAs
• e1b25e1 ci: raise the Dependabot open pull request limit to 50
• 97c92aa ci: effectively remove the Dependabot open pull request limit
• d0b5c35 ci: add a Semgrep job for findings a pull request adds
• c1f72bc ci: move Semgrep to the org ruleset and name the CI job
• f13b413 ci: require the existing verify job instead of a duplicate workflow
• 37be9e2 ci: harden workflows and cap Dependabot pull requests