[platform-dev] new PRs using StepSecurity

[Francisco Perez <francisco.perez@xxxxxxxxxxxxxxxxxxxxxx>]

Hi,

I am Francisco Perez, a member of the Eclipse Foundation security team. 

I am writing to you because we have analyzed all the repositories in the GitHub organization eclipse-platform using  Scorecard and we have found out some improvements could be made.

We will create an issue where we will summarize all the best Security Best Practices identified and create PRs to help you with applying those Security Best Practices You may see some of those PRs coming from StepSecurity as this is a tool we use to help us implement those fixes at scale.. 

The PR above will cover some or all of the following best practices:

• Apply least privilege principle to GITHUB_TOKEN

• Add or fine tune the use of Dependabot

• Pin GitHub actions to a full length commit SHA

Please don’t hesitate and reach out if there is something unclear above.

Kind Regards,

Francisco Perez 

Open Source Software Engineer | Eclipse Foundation

Eclipse Foundation: The Platform for Open Innovation and Collaboration