fix(ci): update reusable workflow SHAs to @7fdc2705df74b4e352d2a1cde3e87a5923fdf329

.editorconfig

@@ -1,60 +1,68 @@
-# EditorConfig helps developers define and maintain consistent
-# coding styles between different editors and IDEs
+# RSR-template-repo - Editor Configuration
 # https://editorconfig.org
 
 root = true
 
-# Default settings for all files
 [*]
 charset = utf-8
 end_of_line = lf
+indent_size = 2
 indent_style = space
-indent_size = 4
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-# Matched file extensions
-[*.{py,js,ts,jsx,tsx,json,yml,yaml,toml,md,html,css,scss,less,sass,sh,zsh,bash,fish,rst,txt,ql,sql,csv,tsv,xml,svg,rs,go,java,kt,kts,scala,rb,php,swift,dart,elm,lua,zig,coq,v,agda,idr,purs}]
-indent_size = 4
+[*.md]
+trim_trailing_whitespace = false
 
-# Makefile requires tabs
-[Makefile]
-indent_style = tab
+[*.adoc]
+trim_trailing_whitespace = false
 
-# Dockerfile
-[Dockerfile]
-indent_style = space
+[*.rs]
 indent_size = 4
 
-# Shell scripts
-[*.{sh,zsh,bash,fish}]
+[*.ex]
 indent_size = 2
 
-# Haskell
+[*.exs]
+indent_size = 2
+
+[*.zig]
+indent_size = 4
+
+[*.ada]
+indent_size = 3
+
+[*.adb]
+indent_size = 3
+
+[*.ads]
+indent_size = 3
+
 [*.hs]
 indent_size = 2
 
-# Nix
-[*.nix]
+[*.res]
 indent_size = 2
 
-# Rust
-[*.rs]
-indent_size = 4
+[*.resi]
+indent_size = 2
 
-# Go
-[*.go]
-indent_style = tab
+[*.ncl]
+indent_size = 2
 
-# Zig
-[*.zig]
-tab_width = 4
-indent_style = space
+[*.rkt]
+indent_size = 2
 
-# Markdown - preserve line breaks
-[*.md]
-trim_trailing_whitespace = false
+[*.scm]
+indent_size = 2
 
-# Configuration files
-[*.{json,yml,yaml,toml,xml,svg}]
+[*.nix]
 indent_size = 2
+
+[Justfile]
+indent_style = space
+indent_size = 4
+
+[justfile]
+indent_style = space
+indent_size = 4

.gitattributes

@@ -1,89 +1,54 @@
-# Auto-detect text files and perform LF normalization
-* text=auto
-
-# Denote all Python files as text
-*.py text
-
-# Denote all shell scripts as text
-*.sh text
-
-# Denote all Markdown files as text
-*.md text
-
-# Denote all YAML files as text
-*.yaml text
-*.yml text
-
-# Denote all JSON files as text
-*.json text
-
-# Denote all TOML files as text
-*.toml text
-
-# Denote all JavaScript/TypeScript files as text
-*.js text
-*.ts text
-*.jsx text
-*.tsx text
-
-# Denote all HTML files as text
-*.html text
-
-# Denote all CSS files as text
-*.css text
-
-# Denote all Rust files as text
-*.rs text
-
-# Denote all Java files as text
-*.java text
-
-# Denote all Go files as text
-*.go text
-
-# Denote all C/C++ files as text
-*.c text
-*.cpp text
-*.h text
-*.hpp text
-
-# Denote all Lua files as text
-*.lua text
-
-# Denote all Zig files as text
-*.zig text
-
-# Line endings
-*.sh eol=lf
-*.py eol=lf
-*.md eol=lf
-*.yaml eol=lf
-*.yml eol=lf
-*.json eol=lf
-*.toml eol=lf
-*.js eol=lf
-*.ts eol=lf
-Makefile eol=lf
-Dockerfile eol=lf
-
-# Language-specific attributes
-*.py diff=python
-*.js diff=javascript
-*.ts diff=typescript
-*.rs diff=rust
-*.go diff=go
-*.java diff=java
-*.zig diff=zig
-
-# Linguist-specific overrides
-*.coq linguist-language=Coq
-*.v linguist-language=V
-*.agda linguist-language=Agda
-*.idr linguist-language=Idris
-*.purs linguist-language=PureScript
-*.elm linguist-language=Elm
-*.rkt linguist-language=Racket
-*.scm linguist-language=Scheme
-*.clj linguist-language=Clojure
-*.cljs linguist-language=Clojure
-*.cljc linguist-language=Clojure
+# SPDX-License-Identifier: MPL-2.0
+# RSR-compliant .gitattributes
+
+* text=auto eol=lf
+
+# Source
+*.rs    text eol=lf diff=rust
+*.ex    text eol=lf diff=elixir
+*.exs   text eol=lf diff=elixir
+*.jl    text eol=lf
+*.res   text eol=lf
+*.resi  text eol=lf
+*.ada   text eol=lf diff=ada
+*.adb   text eol=lf diff=ada
+*.ads   text eol=lf diff=ada
+*.hs    text eol=lf
+*.chpl  text eol=lf
+*.scm   text eol=lf
+*.ncl   text eol=lf
+*.nix   text eol=lf
+
+# Docs
+*.md    text eol=lf diff=markdown
+*.adoc  text eol=lf
+*.txt   text eol=lf
+
+# Data
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.toml  text eol=lf
+
+# Config
+.gitignore     text eol=lf
+.gitattributes text eol=lf
+justfile       text eol=lf
+Makefile       text eol=lf
+Containerfile  text eol=lf
+
+# Scripts
+*.sh   text eol=lf
+
+# Binary
+*.png   binary
+*.jpg   binary
+*.gif   binary
+*.pdf   binary
+*.woff2 binary
+*.zip   binary
+*.gz    binary
+
+# Lock files
+Cargo.lock  text eol=lf -diff
+flake.lock  text eol=lf -diff

.github/dependabot.yml

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MPL-2.0
+# Dependabot configuration for RSR-compliant repositories
+# Covers common ecosystems - remove unused ones for your project
+
+version: 2
+updates:
+  # GitHub Actions - always include
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns:
+          - "*"
+
+  # Rust/Cargo
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    # `open-pull-requests-limit: 0` suppresses routine version-update PRs
+    # while leaving Dependabot SECURITY PRs flowing. The previous
+    # `ignore: "*" patch` rule also silenced security PRs under GitHub\'s
+    # current Dependabot behaviour. See rsr-template-repo commit 78b050e
+    # and 007-lang/audits/audit-dependabot-automation-gap-2026-04-17.md.
+    open-pull-requests-limit: 0
+
+  # Elixir/Mix
+  - package-ecosystem: "mix"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Node.js/npm
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Python/pip
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  # Nix flakes
+  - package-ecosystem: "nix"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -18,6 +18,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
@@ -42,12 +43,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3.28.1
+        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/governance.yml

@@ -9,6 +9,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/guix-nix-policy.yml

@@ -12,6 +12,7 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:

.github/workflows/hypatia-scan.yml

@@ -11,6 +11,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 

.github/workflows/instant-sync.yml

@@ -9,6 +9,7 @@ on:
     types: [published]
 
 permissions:
+  actions: read
   contents: read
 
 jobs: