RED-6621 - InfoSec review changes

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "pub"
+    directory: "/__tests__/fixtures/checks"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pub"
+    directory: "/__tests__/fixtures/test-unit/with-chrome"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pub"
+    directory: "/__tests__/fixtures/test-unit/without-chrome"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: "weekly"
+    groups:
+      all:
+        patterns: ["*"]

.github/workflows/test-unit.yaml

@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Install yq
         run: |
-          sudo wget -O /usr/local/bin/yq https://github.com/mikefarah/yq/releases/download/v4.43.1/yq_linux_amd64
+          sudo wget -O /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
           sudo chmod +x /usr/local/bin/yq
       - working-directory: ${{ inputs.package-path }}
         id: analyze

SECURITY.md

@@ -0,0 +1,6 @@
+# gha-dart-oss
+
+This repo contains workflows for linting, unit testing, and publishing dart code. It has a low attack surface.
+
+* Since this repo will open sourced soon, be careful to not check any secrets into source code.
+* Since there are a lot of bash commands run in the yaml, be careful for command injection coming from unexpected user input.