[DWS] SHA-pin GitHub Actions, and replace Snyk and Gitleaks with GitHub secret scanning

[nickwinder]

Follow-up to #16, which was approved with a request to SHA-pin the GitHub Actions.

SHA pinning

All 20 uses: references across the four workflows now name a full commit SHA, with the release in a trailing comment so the version stays readable and Dependabot can still open update PRs.

Action	Pin
actions/checkout	3d3c42e5… # v7.0.1
actions/setup-node	82076278… # v7.0.0
actions/upload-artifact	043fb46d… # v7.0.1
actions/github-script	3a2844b7… # v9.0.0

A tag is a mutable pointer. Anyone who can move it can run their code with this repository's workflow token and secrets. A commit SHA cannot be moved.

Removing two scans that never ran

Snyk. The step was gated behind if: env.SNYK_TOKEN != ''. No SNYK_TOKEN secret exists on the repository or the organization, so the guard was always false. continue-on-error: true meant it could not have failed the job even if it had run. npm audit --production --audit-level=moderate already runs two steps earlier in the same job, against the same dependency tree, and needs no token.

Gitleaks. The action requires a licence key for repositories owned by an organization. No GITLEAKS_LICENSE secret exists, so the step failed on every run, and continue-on-error: true hid that failure.

What replaces them

GitHub secret scanning and push protection are now enabled on the repository. Push protection rejects a commit containing a recognised credential before it reaches the remote, where Gitleaks could only report a key that was already published. CodeQL default setup is also enabled, covering actions and javascript-typescript.

The workflow keeps its own check for the Nutrient key formats (pdf_live_, its base64 form, sk_|pk_|nutr_sk_). Those are not GitHub partner patterns, so nothing else looks for them.

fetch-depth: 0 and the security-events: write permission went with the Gitleaks step. Only Gitleaks needed the full history and the SARIF upload.

Verification

Local, on fb2025a:

$ npm run typecheck && npm run lint && npm run test:unit
> tsc --noEmit && tsc --noEmit --project src/__tests__/tsconfig.json
> eslint src
Test Suites: 11 passed, 11 total
Tests:       315 passed, 315 total

Every workflow file still parses, and no unpinned reference remains:

$ python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]"
$ grep -rn "uses:" .github/workflows/ | grep -vE "@[0-9a-f]{40} # v"
(no output)

Each pinned SHA was resolved from the GitHub API and confirmed to match the release named in its comment, for example:

$ gh api repos/actions/checkout/commits/v7.0.1 --jq .sha
3d3c42e5aac5ba805825da76410c181273ba90b1

The checkout, setup-node, github-script and upload-artifact pins were exercised end to end by CI on #16 before the merge: 11 checks passed, including unit tests on Node 22 and 24 across ubuntu, windows and macos.

Repository settings, applied and read back:

$ gh api repos/:owner/:repo --jq .security_and_analysis
secret_scanning:                 enabled
secret_scanning_push_protection: enabled

$ gh api repos/:owner/:repo/code-scanning/default-setup --jq .state
configured