[StepSecurity] Apply security best practices

[step-security-bot]

Summary

This pull request is created by Secure Workflows at the request of @Devils-Knight. Please merge the Pull Request to incorporate the requested changes. Please tag @Devils-Knight on your message if you have any questions related to the PR. You can also engage with the StepSecurity team by tagging @step-security-bot.

Security Fixes

Detect Vulnerabilities with SAST Workflow

Static Code Analysis (also known as Source Code Analysis) is usually performed as part of a Code Review (also known as clear-box testing) and is carried out at the Implementation phase of a Security Development Lifecycle (SDL). Static Code Analysis commonly refers to the running of Static Code Analysis tools that attempt to highlight possible vulnerabilities within ‘static’ (non-running) source code by using techniques such as Taint Analysis and Data Flow Analysis.

• The Open Source Security Foundation (OpenSSF) Security Guide
• OWASP Static Code Analysis
• Github Guide For Code Scanning### Manage Dependencies using Dependency Review Workflow

Dependency review helps you understand dependency changes and the security impact of these changes at every pull request. It provides an easily understandable visualization of dependency changes with a rich diff on the "Files Changed" tab of a pull request.
Dependency review informs you of:

1. Which dependencies were added, removed, or updated, along with the release dates.
2. How many projects use these components.
3. Vulnerability data for these dependencies.

For more info:

• Github Guide about Dependency Review
• Github Guide for Configuring Dependency Review### Flag Supply Chain Attacks using Scorecards-Action

Scorecards is an automated security tool that identifies risky supply chain practices in open source projects. This release includes a new Scorecards GitHub Action, new security checks, and a large increase in the repositories included in the foundations weekly scans.

• The Open Source Security Foundation (OpenSSF) Security Guide
• Github Guide For Security Hardening

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-workflows. To create such PRs, please visit https://app.stepsecurity.io/securerepo.

Signed-off-by: StepSecurity Bot bot@stepsecurity.io