security: harden CI with locked installs, vuln scanning, and minimal permissions

- Add permissions: {} at workflow level; each job opts in to contents: read only
- Use --frozen flag on uv sync to fail fast on stale lockfile
- Add security job using uvx uv-secure to scan uv.lock on every push/PR
- Gate publish on security job passing
- Add SECURITY.md with private disclosure path via GitHub Security Advisories

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: flyersworder

.github/workflows/ci.yml

@@ -23,22 +23,28 @@ on:
         required: false
         default: 'false'
 
+permissions: {}
+
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
       - run: uv python install 3.13
-      - run: uv sync --all-extras --dev
+      - run: uv sync --all-extras --dev --frozen
       - run: uv run ruff check src/ tests/
       - run: uv run ruff format --check src/ tests/
 
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ["3.12", "3.13"]
@@ -49,11 +55,20 @@ jobs:
           enable-cache: true
           cache-dependency-glob: "pyproject.toml"
       - run: uv python install ${{ matrix.python-version }}
-      - run: uv sync --all-extras --dev
+      - run: uv sync --all-extras --dev --frozen
       - run: uv run pytest --cov=agentic_data_contracts --cov-report=term-missing
 
+  security:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
+      - run: uvx uv-secure uv.lock
+
   publish:
-    needs: [lint, test]
+    needs: [lint, test, security]
     if: github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.run_publish == 'true')
     runs-on: ubuntu-latest
     permissions:

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release receives security fixes.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Report them privately via [GitHub Security Advisories](https://github.com/flyersworder/agentic-data-contracts/security/advisories/new). Include a description of the issue, steps to reproduce, and the potential impact.
+
+You can expect an acknowledgement within 48 hours and a patch or mitigation plan within 14 days for confirmed issues.