ci: harden workflows for OpenSSF Scorecard; fix Dependabot alerts

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @btoron

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly

.github/workflows/publish.yml

@@ -14,15 +14,17 @@ on:
 
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     environment:
       name: pypi
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ inputs.ref }}
 
@@ -34,7 +36,7 @@ jobs:
           echo "Publishing version: $VERSION from ${{ inputs.ref }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Set up Python
         run: uv python install 3.14

.github/workflows/release.yml

@@ -5,8 +5,7 @@ on:
     types: [closed]
 
 permissions:
-  contents: write
-  id-token: write
+  contents: read
 
 jobs:
   release:
@@ -16,10 +15,13 @@ jobs:
        contains(github.event.pull_request.labels.*.name, 'release:minor') ||
        contains(github.event.pull_request.labels.*.name, 'release:major'))
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     environment:
       name: pypi
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -43,7 +45,7 @@ jobs:
           fi
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Set up Python
         run: uv python install 3.14

.github/workflows/test.yml

@@ -16,10 +16,10 @@ jobs:
       matrix:
         python-version: ["3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@38f3f104447c67c051c4a08e39b64a148898af3a # v4.2.0
 
       - name: Set up Python
         run: uv python install ${{ matrix.python-version }}

SECURITY.md

@@ -2,8 +2,16 @@
 
 ## Supported Versions
 
-Currently we are supporting only ofsc v2.X
+| Version | Supported |
+| ------- | --------- |
+| 2.x     | Yes       |
+| < 2.0   | No        |
 
 ## Reporting a Vulnerability
 
-Please report vulnerabilities by opening an issue. The repository is actively monitored via Dependabot & Snyk
+Please do not report security vulnerabilities in public issues.
+
+Report them privately through GitHub's private vulnerability reporting:
+https://github.com/btoron/pyOFSC/security/advisories/new
+
+Include a description of the issue, the affected versions, and steps to reproduce it. You should receive an initial response within 7 days. Once a fix is available, the advisory will be published along with a new release.

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ofsc"
-version = "2.27.0"
+version = "2.27.1"
 description = "Python wrapper for Oracle Field Service API"
 authors = [{ name = "Borja Toron", email = "borja.toron@gmail.com" }]
 requires-python = ">=3.13"