[tycho-dev] new PRs using StepSecurity

[Francisco Perez <francisco.perez@xxxxxxxxxxxxxxxxxxxxxx>]

Hi,

I am Francisco Perez, a member of the Eclipse Foundation security team. 

I am reaching out because I have analyzed all the repositories in the GitHub organization eclipse-tycho/tycho using  Scorecard and it has found out that the security posture of some repositories could be improved.

I will create an issue where I will summarize all the Security Best Practices identified and create PRs to help you with applying those Security Best Practices. You may see some of those PRs coming from StepSecurity as this is a tool we use to help us implement those fixes at scale. 

The PR mentioned above will cover some or all of the following best practices:

• Apply least privilege principle to GITHUB_TOKEN

• Add or fine tune the use of Dependabot

• Pin GitHub actions to a full length commit SHA

Please don’t hesitate and reach out if there is something unclear above.

Kind Regards,

Francisco Perez 

Open Source Software Engineer | Eclipse Foundation

Eclipse Foundation: The Platform for Open Innovation and Collaboration