A variety of changes

.github/ISSUE_TEMPLATE/language_issues.md

@@ -1,5 +1,5 @@
 ---
-name: Language Issue
+name: ThesaurusEntry Issue
 about: Use this template to report issues with a language
 ---
 

.github/ISSUE_TEMPLATE/language_request.md

@@ -1,5 +1,5 @@
 ---
-name: Language Request
+name: ThesaurusEntry Request
 about: Use this template to request a new language
 ---
 

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  # Keep GitHub Actions (including SHA pins) up to date.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10

.github/workflows/check-docker-build.yml

@@ -2,12 +2,26 @@ name: Check Docker Build
 
 on:
   pull_request:
+    paths:
+      - 'Dockerfile'
+      - 'docker-compose.yml'
+      - 'docker-entrypoint.sh'
+      - 'requirements.txt'
+      - 'Procfile'
+      - '.github/workflows/check-docker-build.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docker-build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check:
     name: Check Docker Build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Docker Compose Build
         run: docker compose build

.github/workflows/codeql.yml

@@ -0,0 +1,55 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "main" ]
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '45 4 * * *' # Daily at 04:45 UTC
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      with:
+        languages: ${{ matrix.language }}
+        queries: security-extended
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/issue-auto-unassign.yml

@@ -1,16 +1,21 @@
+name: Auto-Unassign Inactive Issues
+
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
     - cron:  '0 0/12 * * *'
   workflow_dispatch: # Enable manual runs of the bot
 
+permissions:
+  issues: write
+
 jobs:
   unassign_issues:
     runs-on: ubuntu-latest
     name: Unassign issues
     steps:
       - name: Unassign issues
-        uses: codethesaurus/unassign-issues@1.3
+        uses: codethesaurus/unassign-issues@fec46824b2acd69b012edb5db2101399019be0b6 # 1.3
         id: unassign_issues
         with:
           token: ${{secrets.GITHUB_TOKEN}}

.github/workflows/json-validate.yml

@@ -5,14 +5,32 @@ on:
     paths:
       - '**.json'
   pull_request:
+    paths:
+      - '**.json'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: json-syntax-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   check:
     name: Check JSON Files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
       - name: JSON Syntax Check
-        uses: limitusus/json-syntax-check@v1
-        with:
-          pattern: "\\.json$"
+        run: |
+          failed=0
+          while IFS= read -r -d '' file; do
+            if python3 -m json.tool "$file" > /dev/null 2>&1; then
+              echo "OK: $file"
+            else
+              echo "Invalid JSON: $file"
+              failed=1
+            fi
+          done < <(find . -type f -name '*.json' -not -path './.git/*' -not -path './venv/*' -print0)
+          exit "$failed"

.github/workflows/run-unit-tests.yml

@@ -4,22 +4,41 @@ on:
   push:
     branches:
       - main
+    paths:
+      - 'web/**'
+      - 'codethesaurus/**'
+      - 'requirements.txt'
+      - 'manage.py'
+      - '.github/workflows/run-unit-tests.yml'
   pull_request:
     branches:
       - main
+    paths:
+      - 'web/**'
+      - 'codethesaurus/**'
+      - 'requirements.txt'
+      - 'manage.py'
+      - '.github/workflows/run-unit-tests.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: unit-tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   run:
     name: Run Django Unit Tests
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.14
+          python-version: '3.14'
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/security.yml

@@ -0,0 +1,73 @@
+name: Security Scans
+
+on:
+  push:
+    branches: [ "main" ]
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+      - '.github/workflows/security.yml'
+  pull_request:
+    branches: [ "main" ]
+    paths:
+      - '**.py'
+      - 'requirements.txt'
+      - '.github/workflows/security.yml'
+  schedule:
+    - cron: '30 4 * * *' # Daily at 04:30 UTC
+
+concurrency:
+  group: security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  bandit:
+    name: Bandit (SAST)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+          cache: 'pip'
+
+      - name: Install Bandit
+        run: pip install bandit==1.9.4
+
+      - name: Run Bandit
+        # -r: recursive, -ll: medium severity or higher, -x: exclude directories
+        run: bandit -r . -ll -x ./venv,./web/tests,./staticfiles
+
+  dependency-check:
+    name: Dependency Scan (pip-audit)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.14'
+          cache: 'pip'
+
+      - name: Install pip-audit
+        run: pip install pip-audit==2.10.1
+
+      - name: Run pip-audit
+        run: pip-audit -r requirements.txt
+
+  osv-scanner:
+    name: Dependency Scan (OSV)
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0

.github/workflows/validate-language-info-files.yml

@@ -15,12 +15,12 @@ jobs:
     steps:
 
       - name: Checkout the branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.14
+          python-version: '3.14'
           cache: 'pip'
 
       - name: Install dependencies

.github/workflows/validate-meta-info-file.yml

@@ -15,12 +15,12 @@ jobs:
     steps:
 
       - name: Checkout the branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: 3.14
+          python-version: '3.14'
           cache: 'pip'
 
       - name: Install dependencies

.gitignore

@@ -7,3 +7,4 @@ __pycache__
 public_html/
 staticfiles/
 *.sqlite3
+/.junie