chore: #9 Add SECURITY-INSIGHTS and fix CI permissions

Signed-off-by: Laurent Broudoux <[email protected]>

.github/workflows/cicd.yml

@@ -4,15 +4,25 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - '.gitignore'
+      - 'LICENSE'
+      - '*.md'
   pull_request:
     branches:
       - main
+    paths-ignore:
+      - '.gitignore'
+      - 'LICENSE'
+      - '*.md'
 
 env:
     DOTNET_CLI_TELEMETRY_OPTOUT: 1
     DOTNET_SKIP_FIRST_TIME_EXPERIENCE: 1
     DOTNET_NOLOGO: 1
 
+permissions: read-all
+
 jobs:
   commitlint:
     name: 📝 Commitlint

SECURITY-INSIGHTS.yml

@@ -0,0 +1,56 @@
+header:
+  schema-version: 1.0.0
+  last-updated: '2024-11-21'
+  last-reviewed: '2024-11-21'
+  expiration-date: '2025-11-21T01:00:00.000Z'
+  project-url: https://github.com/microcks/microcks-testcontainers-dotnet
+  project-release: '0.1.0'
+  changelog: https://github.com/microcks/microcks-testcontainers-dotnet/blob/main/CHANGELOG.md
+  license: https://github.com/microcks/microcks-testcontainers-dotnet/blob/main/LICENSE
+project-lifecycle:
+  status: active
+  roadmap: https://github.com/microcks/microcks-testcontainers-dotnet/blob/main/ROADMAP.md
+  bug-fixes-only: false
+  core-maintainers:
+    - github:lbroudoux
+    - github:yada
+contribution-policy:
+  accepts-pull-requests: true
+  accepts-automated-pull-requests: true
+  code-of-conduct: https://github.com/microcks/.github/blob/master/CODE_OF_CONDUCT.md
+  contributing-policy: https://github.com/microcks/.github/blob/master/CONTRIBUTING.md
+documentation:
+  - https://microcks.io
+distribution-points:
+  - https://microcks.io
+  - https://github.com/microcks/microcks-testcontainers-dotnet
+  - https://quay.io/microcks
+security-artifacts:
+  threat-model:
+    threat-model-created: false
+security-testing:
+  - tool-type: sca
+    tool-name: Dependabot
+    tool-version: latest
+    integration:
+      ad-hoc: true
+      ci: false
+      before-release: false
+    comment: |
+      Dependabot is enabled for this repo on a weekly scheduled basis.
+security-contacts:
+  - type: email
+    value: [email protected]
+vulnerability-reporting:
+  accepts-vulnerability-reports: true
+  security-policy: https://github.com/microcks/microcks-testcontainers-dotnet/security/policy
+  email-contact: [email protected]
+  comment: |
+    To report a security issue for one of the libraries owned by the Microcks community, write an email with a detailed description of the issue to [email protected].
+dependencies:
+  third-party-packages: true
+  dependencies-lists:
+    - https://github.com/microcks/microcks-testcontainers-dotnet/network/dependencies
+    - https://app.fossa.com/projects/git%2Bgithub.com%2Fmicrocks%2Fmicrocks-testcontainers-dotnet/refs/branch/main/a861e43bd7ebb61b52df98c17177bc74823fae89/browse/dependencies
+  env-dependencies-policy:
+    policy-url: https://github.com/microcks/microcks-testcontainers-dotnet/blob/main/DEPENDENCY_POLICY.md