[Redtigercod4]

Summary

Implements #362 for Pull Requests against the main branch, moving from the previous pr-checks.yml to a per-job concern reusable workflow approach. Based on OWASP CI/CD Top 10 recommendations, this approach now implements SAST, SCA and further testing within the project. It also now takes advantage of the new github actions action-lock feature for ensuring actions are now versioned correctly.

Changes

1. Renamed pr-check.yml to pull-request.yml overhauling it with reusable workflows and the inline merge-commit check.
2. Created new composite action for npm installation with original checks against package-lock,json changes.
3. Adds sarif-upload.yml workflow within main to allow CodeQL and over SARIF producing actions to upload to the Pull request with the correct permissions.
4. Adds new actions.lock for version control of github actions.
5. Added zizmor.yml for documentation overrides against recommended controls within the actions.
6. Added osv-scanner.toml for documenting known CVEs within dependencies that currently can not be addressed.

Out of Scope

1. Folding Cypress.yml into a dedicated reusable workflow.
2. main.yml / schedule.yml / release.yml restructuring under Proposal: Overhaul PulpUI Github Actions to a hardened, per job-concern model. #362
3. secrets-scanning is wired but disabled. See blockers.

Blockers

1. gitleaks/gitleaks-action is blocked by a Pulp Organisation actions allow-list. Chore: gitleaks/gitleaks-action blocked by org Actions allow-list policy #398

Linked Issues & Epics

1. Proposal: Overhaul PulpUI Github Actions to a hardened, per job-concern model. #362
2. Chore: gitleaks/gitleaks-action blocked by org Actions allow-list policy #398

AI Assistance

Consulted Claude (Sonnet 5) through for verifying design decisions and debugging pipeline failures. Pull Request was peer reviewed by Claude (Sonnet 5.5) & OpenAI (GPT-6).

Sources

1. https://docs.zizmor.sh/
2. https://google.github.io/osv-scanner
3. https://github.com/gitleaks/gitleaks
4. https://github.com/github/gh-actions-lock
5. Security Advisory: Prototype Pollution via mergeObject() (CVE-2026-93753 / GHSA-gcqx-w48m-w2h4) TehShrike/deepmerge#285

[ggainey]

Looks much easier to find/maintain the individual steps. Secures GH-action usage in useful ways, considering the current SDLC environment. Approved.