ci: Update workflows & add CODEOWNERS/Dependabot (#683)

Signed-off-by: Roger Barker <[email protected]>

.github/CODEOWNERS

@@ -0,0 +1,39 @@
+###################################
+##### Global Protection Rule ######
+###################################
+# NOTE: This rule is overriden by the more specific rules below. This is the catch-all rule for all files not covered by the more specific rules below.
+* @hashgraph/hedera-sdk @hashgraph/hedera-sdk-cpp-contributors @hashgraph/limechain-hedera
+
+#########################
+##### Core Files ######
+#########################
+
+# NOTE: Must be placed last to ensure enforcement over all other rules
+
+# Protection Rules for Github Configuration Files and Actions Workflows
+/.github/ @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Cmake project files and inline plugins
+**/.clang* @hashgraph/release-engineering @hashgraph/release-engineering-managers @hashgraph/hedera-sdk
+**/.clang-format @hashgraph/release-engineering @hashgraph/release-engineering-managers @hashgraph/hedera-sdk
+**/.clang-tidy @hashgraph/release-engineering @hashgraph/release-engineering-managers @hashgraph/hedera-sdk
+**/CMakeLists.txt @hashgraph/release-engineering @hashgraph/release-engineering-managers @hashgraph/hedera-sdk
+**/CMakePresets.json @hashgraph/release-engineering @hashgraph/release-engineering-managers @hashgraph/hedera-sdk
+
+# Codacy Tool Configurations
+/config/ @hashgraph/release-engineering @hashgraph/release-engineering-managers
+.remarkrc @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Self-protection for root CODEOWNERS files (this file should not exist and should definitely require approval)
+/CODEOWNERS @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Protect the repository root files
+/README.md @hashgraph/release-engineering @hashgraph/release-engineering-managers
+**/LICENSE @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# CodeCov configuration
+**/codecov.yml @hashgraph/release-engineering @hashgraph/release-engineering-managers
+
+# Git Ignore definitions
+**/.gitignore @hashgraph/release-engineering @hashgraph/release-engineering-managers
+**/.gitignore.* @hashgraph/release-engineering @hashgraph/release-engineering-managers

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+ - package-ecosystem: "github-actions"
+ directory: "/"
+ schedule:
+ interval: "daily"
+ open-pull-requests-limit: 10

.github/workflows/flow-pull-request-checks.yaml

@@ -8,6 +8,9 @@ on:
  - synchronize
  - closed
 
+defaults:
+ run:
+ shell: bash
 
 concurrency:
  group: pr-checks-${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/zxc-build-library.yaml

@@ -12,30 +12,29 @@ permissions:
 jobs:
  build:
  name: Build
- runs-on:
- - self-hosted
- - "${{ matrix.os }}"
- - xlarge
- - ephemeral
+ runs-on: [ self-hosted, Linux, xlarge, ephemeral ]
+
  env:
  HEDERA_NETWORK: localhost
  strategy:
  matrix:
  include:
  - os: Linux
  preset: linux-x64
- # - os: macos-12
- # preset: macos-x64
- # - os: windows-latest
- # preset: windows-x64
+
  steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+ with:
+ egress-policy: audit
+
  - name: Checkout Code
- uses: actions/checkout@v3
+ uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
  with:
  submodules: true
 
  - name: Run Clang-Format
- uses: jidicula/[email protected]
+ uses: jidicula/clang-format-action@f62da5e3d3a2d88ff364771d9d938773a618ab5e # v4.11.0
  with:
  clang-format-version: "17"
  check-path: "src"
@@ -55,19 +54,16 @@ jobs:
  $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
  sudo apt-get update
  sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
- if: ${{ runner.os == 'Linux' }}
 
  - name: Use Node.js 21
- uses: actions/setup-node@v3
+ uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
  with:
  node-version: 21
 
  - name: Install Local Node
  run: sudo npm install -g @hashgraph/hedera-local
- if: ${{ runner.os == 'Linux' }}
 
  - name: Install Linux Prerequisites
- if: ${{ runner.os == 'Linux' }}
  run: |
  sudo apt-get update
  sudo apt-get install -y pkg-config libc6-dbg libgtest-dev build-essential
@@ -76,10 +72,10 @@ jobs:
  run: mkdir -p "${{ github.workspace }}/b/vcpkg_cache"
 
  - name: Install CMake & Ninja
- uses: lukka/get-cmake@v3.27.7
+ uses: lukka/get-cmake@4931ab1fc1604964c055eb330edb3f6b26ba0cfa # v3.29.2
 
  - name: Setup VCPkg
- uses: lukka/run-vcpkg@v11
+ uses: lukka/run-vcpkg@5e0cab206a5ea620130caf672fce3e4a6b5666a1 # v11.5
  with:
  binaryCachePath: ${{ github.workspace }}/b/vcpkg_cache
 
@@ -89,7 +85,7 @@ jobs:
  git fetch --unshallow --prune
 
  - name: CMake Build (Debug)
- uses: lukka/run-cmake@v10
+ uses: lukka/run-cmake@2ce8982be71b8e9a3c4d5e432135035afd1e76a7 # v10.7
  env:
  VCPKG_BINARY_SOURCES: clear
  with:
@@ -98,7 +94,7 @@ jobs:
 
  - name: CMake Build (Release)
  if: github.event.pull_request.merged == true
- uses: lukka/run-cmake@v10
+ uses: lukka/run-cmake@2ce8982be71b8e9a3c4d5e432135035afd1e76a7 # v10.7
  env:
  VCPKG_BINARY_SOURCES: clear
  with:
@@ -129,7 +125,7 @@ jobs:
 
  - name: Attach Artifact
  if: github.event.pull_request.merged == true
- uses: actions/upload-artifact@v3
+ uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
  with:
  name: hapi-library-${{ runner.os }}-${{ steps.sha.outputs.short }}
  path: package/