[m2e-dev] new PRs using StepSecurity

[Francisco Perez <francisco.perez@xxxxxxxxxxxxxxxxxxxxxx>]

Hi,

I am Francisco Perez, a member of the Eclipse Foundation security team. I am writing to you because we have analyzed all the repositories in the GitHub organization https://github.com/eclipse-m2e using Scorecard and we have found out some improvements could be made. We will use a tool named StepSecurity to create PRs to help you fix those issues. 

The PR will cover some or all of the following best practices:

• Apply least privilege principle to GITHUB_TOKEN

• Add or fine tune the use of Dependabot

• Pin actions to a full length commit SHA

Please don’t hesitate and reach out if there is something unclear above.

Kind Regards,

Francisco Perez 

Open Source Software Engineer | Eclipse Foundation

Eclipse Foundation: The Platform for Open Innovation and Collaboration