[StepSecurity] Apply security best practices

.github/dependabot.yml

@@ -1,11 +1,8 @@
-# Set update schedule for GitHub Actions
-
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      # Check for updates to GitHub Actions every week
       interval: "weekly"
     commit-message:
       prefix: "[dependabot] "
@@ -16,3 +13,13 @@ updates:
           - "major"
           - "minor"
           - "patch"
+
+  - package-ecosystem: pip
+    directory: /docs
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: maven
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/build-and-test.yml

@@ -34,7 +34,7 @@ jobs:
           mv ~/.m2/repository/org/locationtech/geomesa m2-geomesa
           tar -czf classes.tgz $(find . -path '*/target/classes' -o -path '*/target/test-classes' -type d | tr '\n' ' ')
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: classes-and-jars
           retention-days: 1

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/integration-tests.yml

@@ -26,7 +26,7 @@ jobs:
           echo ./build/scripts/change-scala-version.sh ${{ inputs.scala-version }}
           ./build/scripts/change-scala-version.sh ${{ inputs.scala-version }}
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: classes-and-jars
       - name: Install artifacts

.github/workflows/unit-tests.yml

@@ -29,7 +29,7 @@ jobs:
           echo ./build/scripts/change-scala-version.sh ${{ inputs.scala-version }}
           ./build/scripts/change-scala-version.sh ${{ inputs.scala-version }}
       - name: Download artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: classes-and-jars
       - name: Install artifacts