feat: adds a hardened, per job-concern model for all pull requests

.github/actions/npm-setup/action.yml

@@ -0,0 +1,27 @@
+name: npm setup
+description: Sets up NodeJS with npm caching and dependencies installed
+
+inputs:
+  node-version:
+    description: NodeJS version
+    required: false
+    default: 24
+  install-command:
+    description: Dependency installation command
+    required: false
+    default: npm clean-install
+
+runs:
+  using: composite
+  steps:
+    - name: Install node ${{ inputs.node-version }}
+      uses: actions/setup-node@v7.1.0
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: 'npm'
+
+    - name: Install dependencies
+      shell: bash
+      env:
+        INSTALL_COMMAND: ${{ inputs.install-command }}
+      run: $INSTALL_COMMAND

.github/dependabot.yml

@@ -1,6 +1,8 @@
 version: 2
 updates:
   - package-ecosystem: 'npm'
+    cooldown:
+      default-days: 7
     directory: '/'
     schedule:
       interval: 'weekly'
@@ -31,6 +33,8 @@ updates:
           - 'version-update:semver-major'
 
   - package-ecosystem: 'github-actions'
+    cooldown:
+      default-days: 7
     directory: '/'
     schedule:
       interval: 'weekly'

.github/workflows/_build.yml

@@ -0,0 +1,21 @@
+name: Build
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: npm Setup
+        uses: $/.github/actions/npm-setup
+
+      - name: Build UI
+        run: npm run build

.github/workflows/_dependency-review.yml

@@ -0,0 +1,20 @@
+name: Dependency Review
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v5.0.0
+        with:
+          fail-on-severity: high

.github/workflows/_lint.yml

@@ -0,0 +1,34 @@
+name: Lint
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: npm Setup
+        uses: $/.github/actions/npm-setup
+        with:
+          install-command: 'npm install'
+
+      - name: 'Fail if npm install changed package-lock.json'
+        run: git diff --exit-code package-lock.json
+
+      - name: Install python 3.13
+        uses: actions/setup-python@v7.1.0
+        with:
+          python-version: '3.13'
+
+      - name: Install lint dependencies
+        run: npm run lint-setup
+
+      - name: Run lint
+        run: npm run lint

.github/workflows/_security-scans.yml

@@ -0,0 +1,83 @@
+name: Security Scans
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  # TODO(#398): Currently blocked by pulp organisation actions allow-list - gitleaks-action isn't permitted.
+  # secret-scanning:
+  # runs-on: ubuntu-latest
+  # steps:
+  #   - name: Checkout pulp-ui (${{ github.ref }})
+  #     uses: actions/checkout@v7.0.1
+  #     with:
+  #       persist-credentials: false
+  #       fetch-depth: 0
+
+  #   - name: Run Gitleaks
+  #     uses: gitleaks/gitleaks-action@v3.0.0
+  #     env:
+  #       GITHUB_TOKEN: ${{ github.token }}
+
+  software-composition-analysis:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run OSV-Scanner
+        uses: google/osv-scanner-action/osv-scanner-action@v2.7.0
+        with:
+          scan-args: |-
+            --lockfile=package-lock.json
+            --format=sarif
+            --output-file=osv-results.sarif
+
+      - name: Upload SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v7.0.2
+        with:
+          name: osv-results
+          path: osv-results.sarif
+          retention-days: 1
+
+  codeql:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: npm Setup
+        uses: $/.github/actions/npm-setup
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4.39.1
+        with:
+          languages: javascript-typescript
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4.39.1
+        with:
+          upload: never
+          output: sarif-results
+
+      - name: Fail on findings
+        run: |
+          count=$(jq -s '[.[] | .runs[].results[]] | length' sarif-results/*.sarif)
+          echo "CodeQL found $count issue(s)"
+          [ "$count" -eq 0 ]
+
+      - name: Upload SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v7.0.2
+        with:
+          name: codeql-results
+          path: sarif-results
+          retention-days: 1

.github/workflows/_test.yml

@@ -0,0 +1,35 @@
+name: Test
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  integration-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: npm Setup
+        uses: $/.github/actions/npm-setup
+
+      - name: Run tests
+        run: npm run test:integration
+
+  unit-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: npm Setup
+        uses: $/.github/actions/npm-setup
+
+      - name: Run tests
+        run: npm run test:unit

.github/workflows/_workflow-lint.yml

@@ -0,0 +1,55 @@
+name: Workflow lint
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v10.3.3
+
+      - name: Run zizmor
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: uvx zizmor@1.31.1 --format=sarif . > zizmor-results.sarif
+
+      - name: Fail on findings
+        run: |
+          count=$(jq '[.runs[].results[]] | length' zizmor-results.sarif)
+          echo "zizmor found $count issue(s)"
+          [ "$count" -eq 0 ]
+
+      - name: Upload SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v7.0.2
+        with:
+          name: zizmor-results
+          path: zizmor-results.sarif
+          retention-days: 1
+
+  actions-lock:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout pulp-ui (${{ github.ref }})
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install gh-actions-lock extension
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install github/gh-actions-lock --pin v0.4.0
+
+      - name: Verify actions.lock is up to date
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh actions-lock --verify