docs(changelog): add unreleased security hardening entries

[alain-sv]

Summary

• Add [Unreleased] section to docs/CHANGELOG.md covering all security hardening changes from the current sprint

🤖 Generated with Claude Code

[qodo-code-review]

Review Summary by Qodo

Document security hardening changes in unreleased changelog

📝 Documentation

Walkthroughs

Description

• Add comprehensive security hardening entries to changelog
• Document 12 security improvements across scanning, protection, and supply-chain
• Cover GitHub Actions pinning, Dependabot, OSV-Scanner, and policy additions

Diagram

flowchart LR
  SEC["Security Hardening<br/>Changes"]
  SCAN["Secret Scanning &<br/>Push Protection"]
  DEP["Dependabot &<br/>Automated Updates"]
  VUL["Private Vulnerability<br/>Reporting"]
  BRANCH["Branch & Tag<br/>Rulesets"]
  PYPI["PyPI Environment<br/>Protection"]
  ACTIONS["SHA-pinned<br/>GitHub Actions"]
  FROZEN["uv sync<br/>--frozen"]
  OSV["OSV-Scanner<br/>Integration"]
  CONFIG["Dependabot<br/>Configuration"]
  SECURITY["SECURITY.md &<br/>AGENTS.md Rules"]
  CHANGELOG["CHANGELOG.md<br/>Updated"]
  
  SEC --> SCAN
  SEC --> DEP
  SEC --> VUL
  SEC --> BRANCH
  SEC --> PYPI
  SEC --> ACTIONS
  SEC --> FROZEN
  SEC --> OSV
  SEC --> CONFIG
  SEC --> SECURITY
  
  SCAN --> CHANGELOG
  DEP --> CHANGELOG
  VUL --> CHANGELOG
  BRANCH --> CHANGELOG
  PYPI --> CHANGELOG
  ACTIONS --> CHANGELOG
  FROZEN --> CHANGELOG
  OSV --> CHANGELOG
  CONFIG --> CHANGELOG
  SECURITY --> CHANGELOG

Loading

File Changes

1. docs/CHANGELOG.md 📝 Documentation +15/-0

Add security hardening entries to unreleased changelog

• Added new Security subsection under [Unreleased] section
• Documented 12 security hardening initiatives including secret scanning, push protection, and
 Dependabot
• Listed branch/tag rulesets, PyPI environment protection, and SHA-pinned GitHub Actions
• Included OSV-Scanner integration, frozen lockfile enforcement, and security policy documentation

docs/CHANGELOG.md

---

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0)

1. Dependabot cooldown mismatch 🐞 Bug ≡ Correctness

Description

docs/CHANGELOG.md states Dependabot uses a 5-day cooldown window for both pip and github-actions
ecosystems, but the actual .github/dependabot.yml config sets github-actions cooldown to 7 days.
This makes the unreleased changelog inaccurate and can mislead maintainers about the repository’s
security-update timing.

Code

docs/CHANGELOG.md[31]

+- **Dependabot configuration** (`.github/dependabot.yml`) — weekly updates for `pip` and `github-actions` ecosystems with a 5-day cooldown window to mitigate supply-chain worm attacks; all PRs routed to `develop`.

Evidence

The changelog explicitly documents a 5-day cooldown for both ecosystems, but the repository’s
Dependabot configuration shows github-actions uses a 7-day cooldown, so the documentation does not
match the implemented behavior.

docs/CHANGELOG.md[29-33]
.github/dependabot.yml[23-30]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`docs/CHANGELOG.md` claims Dependabot uses a 5-day cooldown window for both `pip` and `github-actions`, but `.github/dependabot.yml` configures `github-actions` with a 7-day cooldown (`default-days: 7`).

## Issue Context
This PR only changes documentation, so the lowest-risk fix is to update the changelog text to match the current config (or, if the intent truly is 5 days for GitHub Actions too, adjust `.github/dependabot.yml` accordingly and ensure that change is included/approved).

## Fix Focus Areas
- docs/CHANGELOG.md[30-33]
- .github/dependabot.yml[23-30]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ You are approaching your monthly quota for Qodo. Upgrade your plan