Add supply chain security defaults

.github/dependabot.yml

@@ -3,10 +3,14 @@ version: 2
 updates:
 - package-ecosystem: github-actions
   directory: "/"
+  cooldown:
+    default-days: 3
   schedule:
     interval: weekly
 
 - package-ecosystem: npm
   directory: "/"
+  cooldown:
+    default-days: 3
   schedule:
     interval: weekly

.github/workflows/codeql-analysis.yml

@@ -37,6 +37,7 @@ jobs:
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
 
     steps:
+    # TODO(security): Review pinning GitHub-owned actions to full commit SHAs once an update process is in place.
     - name: Checkout repository
       uses: actions/checkout@v5
 

.github/workflows/dependency-submission-example.yml

@@ -3,12 +3,14 @@ name: Example Dependency Submission
 on: push
 
 permissions:
+  # TODO(security): Confirm this example still requires contents: write for dependency submission.
   contents: write
 
 jobs:
   example-submission:
     runs-on: ubuntu-latest
     steps:
+      # TODO(security): Review pinning GitHub-owned actions to full commit SHAs once an update process is in place.
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v6
         with:

.github/workflows/publish.yml

@@ -6,12 +6,14 @@ on:
 
 permissions:
   contents: read
+  # TODO(security): Human review required before changing release publish credentials/provenance behavior.
   id-token: write # for provenance and publish access
 
 jobs:
   publish-npm:
     runs-on: ubuntu-latest
     steps:
+      # TODO(security): Review pinning GitHub-owned actions to full commit SHAs once an update process is in place.
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v6
         with:

.github/workflows/test.yml

@@ -17,6 +17,7 @@ jobs:
   build: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
+      # TODO(security): Review pinning GitHub-owned actions to full commit SHAs once an update process is in place.
       - uses: actions/checkout@v5
       - uses: actions/setup-node@v6
         with:

.npmrc

@@ -0,0 +1 @@
+min-release-age=3