Pin action versions, add Dependabot cooldown and npm release age

[cmillett]

Addresses all 15 high-severity Bastion SAST findings on this repo. Three rules.

1. Mutable action tags — 13 findings

CWE-1357 / CWE-353, OWASP A08. All 14 third-party uses: refs now name an exact version:

Action	Before	After
actions/checkout	@v4	@v4.4.0
actions/github-script	@v6	@v6.4.1
pnpm/action-setup	@v4	@v4.3.0
peter-evans/repository-dispatch	@v2	@v2.1.2
peter-evans/slash-command-dispatch	@v3	@v3.0.2
peter-evans/create-or-update-comment	@v2	@v2.1.1
cycjimmy/semantic-release-action	@v4	@v4.2.2
jwalton/gh-find-current-pr	@master	@v1.3.5

Two were tracking branches, not versions

• cycjimmy/semantic-release-action@v4 — that repo has no v4 tag, so the ref resolved to a branch named v4, i.e. a moving head on the action that cuts releases. Tag v4.2.2 points at the identical commit (16ca923e), so this is behaviour-neutral.
• jwalton/gh-find-current-pr@master — the only ref where the pin is a genuine change: master sits 2 commits ahead of the latest release, so v1.3.5 moves this onto published code. I checked action.yml at that tag still provides the state input and number output this workflow uses.

The commented-out slackapi/slack-github-action@v1 at line 183 was left alone.

Why this doesn't clear the rule

Semgrep wants a 40-character commit SHA. Woosmap policy is exact version tags, so these are recorded as accepted risk in Bastion rather than fixed. Items 2 and 3 cover the same threat from the other direction.

2. Missing Dependabot cooldown — 1 finding

CWE-829. cooldown: default-days: 7 on the npm entry, plus a github-actions ecosystem entry so the pins above get bumped rather than silently going stale. The github-actions entry is additive — happy to drop it if you'd rather not have action-bump PRs.

3. Missing npm minimum release age — 1 finding

CWE-829. .npmrc gains min-release-age=7 as the rule asks, plus minimum-release-age=7, which is pnpm's spelling.

Be aware this is inert today. All three workflows pin pnpm 9.15.9, and the setting landed in pnpm 10.16 / npm 11.10. Unknown keys are ignored by pnpm 9 so there's no risk in landing it now, and it activates the moment the toolchain moves — but if you want the delay actually enforced, pnpm needs bumping to ≥ 10.16. That's a toolchain upgrade, so I kept it out of a config-only change.

Risk and rollback

Only uses: refs, dependabot.yml and .npmrc changed — no workflow inputs, triggers, or job logic. All six workflow files and dependabot.yml verified as parseable YAML; all eight version tags confirmed to resolve upstream. The release, slash-command and schema-notification paths run post-merge rather than on this PR. Rollback is git revert of this commit.

🤖 Generated with Claude Code