From c3e854b98f3d877f3cc69288a650d658ef170a3c Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 19:25:14 +0000
Subject: [PATCH 1/6] Add Dependabot configuration for managing GitHub Actions
 and Python dependencies

---
 .github/dependabot.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..d98e54a1
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# This file is used by GitHub Dependabot to manage dependencies in the project.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: daily

From 37db561a56fe0657dfd0ade87a3f6ab1fa53871c Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 19:27:12 +0000
Subject: [PATCH 2/6] Add pull request trigger to OSSF scoreboard workflow and
 ignore path changes

---
 .github/workflows/ossf-scoreboard.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/ossf-scoreboard.yml b/.github/workflows/ossf-scoreboard.yml
index 9b69a86a..537a8e55 100644
--- a/.github/workflows/ossf-scoreboard.yml
+++ b/.github/workflows/ossf-scoreboard.yml
@@ -7,6 +7,10 @@ on:
   branch_protection_rule:
   schedule:
     - cron: '32 4 * * 5'
+  pull_request:
+    branches: [ "main" ]
+    paths-ignore:
+      - .github/workflows/ossf-scoreboard.yml
   push:
     branches: [ "main" ]
 

From 1b9fcf73c1b63ccc71ef1f6c7d5bd5bc8619c790 Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 19:41:29 +0000
Subject: [PATCH 3/6] Update Trivy workflow to enhance permissions and upgrade
 action versions

---
 .github/workflows/trivy.yml | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 737362b0..6e4e5ed5 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -7,19 +7,17 @@
     merge_group:
     workflow_dispatch:
 
-
-  permissions:
-    actions: read
-    contents: read
-    security-events: write
-
   jobs:
     build:
       name: 'trivy scan'
       runs-on: ubuntu-latest
+      permissions:
+        security-events: write
+        contents: read
+
       steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
+        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
         with:
           egress-policy: audit
 
@@ -37,7 +35,7 @@
           output: report-fs.sarif
 
       - name: Upload Trivy report (fs) GitHub Security
-        uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
+        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
         with:
           sarif_file: report-fs.sarif
           category: 'fs'

From fd419cabb39bd12ff8f65d99de1c427e6a9d17a5 Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 19:43:32 +0000
Subject: [PATCH 4/6] Refactor Trivy workflow for improved readability and
 maintainability

---
 .github/workflows/trivy.yml | 68 ++++++++++++++++++-------------------
 1 file changed, 34 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 6e4e5ed5..65849bdc 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -1,41 +1,41 @@
 ---
-  name: trivy
+name: trivy
 
-  on:
-    pull_request:
-      types: [ 'opened', 'reopened', 'synchronize' ]
-    merge_group:
-    workflow_dispatch:
+on:
+  pull_request:
+    types: [ 'opened', 'reopened', 'synchronize' ]
+  merge_group:
+  workflow_dispatch:
 
-  jobs:
-    build:
-      name: 'trivy scan'
-      runs-on: ubuntu-latest
-      permissions:
-        security-events: write
-        contents: read
+jobs:
+  build:
+    name: 'trivy scan'
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
 
-      steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
-        with:
-          egress-policy: audit
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      with:
+        egress-policy: audit
 
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - name: Checkout code
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Run Trivy vulnerability scanner (file system)
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
-        with:
-          scan-type: 'fs'
-          ignore-unfixed: true
-          scan-ref: .
-          format: 'sarif'
-          scanners: 'vuln,secret,config'
-          output: report-fs.sarif
+    - name: Run Trivy vulnerability scanner (file system)
+      uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
+      with:
+        scan-type: 'fs'
+        ignore-unfixed: true
+        scan-ref: .
+        format: 'sarif'
+        scanners: 'vuln,secret,config'
+        output: report-fs.sarif
 
-      - name: Upload Trivy report (fs) GitHub Security
-        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
-        with:
-          sarif_file: report-fs.sarif
-          category: 'fs'
+    - name: Upload Trivy report (fs) GitHub Security
+      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
+      with:
+        sarif_file: report-fs.sarif
+        category: 'fs'

From dac0826cc6386af5033bf292df15ca00786f1a56 Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 20:30:52 +0000
Subject: [PATCH 5/6] Remove unnecessary lines from Trivy workflow
 configuration

---
 .github/workflows/trivy.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 65849bdc..24c40692 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -1,4 +1,3 @@
----
 name: trivy
 
 on:

From 9ae38bf9e7f0757945d7e7492d9a5d55fc6edd88 Mon Sep 17 00:00:00 2001
From: devanshjain <devanshjain@microsoft.com>
Date: Thu, 27 Mar 2025 20:37:29 +0000
Subject: [PATCH 6/6] Add read-all permissions to Trivy workflow configuration

---
 .github/workflows/trivy.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 24c40692..54b667cb 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -6,6 +6,8 @@ on:
   merge_group:
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   build:
     name: 'trivy scan'