Securing VSCodium

[daiyam]

Hi All,

Following the Axios incident, I've made some changes:

• use of zizmor, a linter for GitHub workflows
• separated workflows for PR and publish
• use of locked dependencies for side projects:
  • https://github.com/VSCodium/repositories-linux
  • https://github.com/VSCodium/vscodium/tree/master/font-size
• add new update.minReleaseAge and extensions.minReleaseAge settings (more details at this discussion)
• secrets have been moved to environments

I also plan:

• use of immutable release in GitHub

To access any environment, it requires a manual validation by me (about 6 times in a release).
Due to that fact, a release would need me to validate them so I've stopped the automatic releases.

I've also moved the passwords specific to VSCodium to a standalone KeePass file (away of my usual password manager).

[darius-r]

Would you consider adding the creation of a 'security.md' file to, amongst other things, indicated the preferred method for reporting of vulnerabilities?