feat: add org-level security and reusable workflow security references

[CybotTM]

Summary

• Add references/org-security-settings.md covering sha_pinning_required org setting, pin-github-action CLI tool (install, usage, batch script), allowed_actions policy, and action allow-list configuration
• Add references/reusable-workflow-security.md covering internal vs external workflow trust models, transitive dependency risks (trivy-action pattern), audit checklist, and shared workflow repos pattern
• Update references/security-config.md Pinned-Dependencies row to cross-reference both new docs

Test plan

• Verify new reference files render correctly in GitHub
• Verify cross-references from security-config.md point to correct filenames
• Verify skill validator passes (if applicable)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the documentation around GitHub Actions security, focusing on organization-level settings and the security considerations for reusable workflows. It introduces new documents detailing SHA pinning requirements, action allow-lists, and best practices for securing reusable workflows, while also updating existing documentation to cross-reference these new resources.

Highlights

• New Documentation: Added documentation on organization-level security settings for GitHub Actions, including SHA pinning and action allow-lists.
• Reusable Workflow Security: Introduced a new reference document detailing the security model for reusable workflows, covering internal vs external workflows and transitive dependency risks.
• Security Configuration Update: Updated the security configuration document to cross-reference the new documentation on org-level security settings and reusable workflow security.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds valuable documentation regarding organization-level security settings and reusable workflow security for GitHub Actions. The new reference documents are comprehensive and the examples are helpful. My review includes several suggestions to improve the clarity, correctness, and usability of the documentation and the example scripts. This includes fixing a resource leak bug in the batch pinning script, improving its error handling, and converting plain-text file paths into clickable Markdown links for better navigation.