ci: [2025-Q2] CI/CD Audit Story

# CI/CD Repository Audit

**Description**:
Perform repository audit.

**If there has not been a significant commit in the last year, add a note indicating so.**
**Skip to `Acceptance Criteria` section at the bottom to complete close this issue.**

# Administrative Audit Criteria

### Actions State
If actions have not been run in the previous 6 months they should be disabled:
- [ ] Actions are/have been disabled

If actions have run in the last 6 months then actions shall remain enabled:
- [x] Actions are enabled

## Settings Window
### General Tab
- [x] Require contributors to sign off on web-based commits

#### Features Section:
- [x] Disable Wiki
- If it is in use, leave Wiki enabled. If not in use, remove functionality (uncheck Wiki option). Should be disabled whenever possible.
- [x] Enable Issues
- [x] Enable Preserve this Repository
- [x] Enable Discussions if repository is public
- [x] Enable Projects

#### Pull Requests Section:
- [x] Enable Allow Squash Merging
- [x] Enable Always suggest updating pull request branches
- [x] Enable Automatically delete head branches

#### Pushes Section:
- [x] Pushes: Limit how many branches and tags can be updated in a single push (Default # is 5)

### Collaborators and Teams Tab
- [x] Teams are assigned to the repository
- [x] Individual contributors that are part of assigned teams are removed from contributors list

### Branches Tab
- [x] Individual branch protections are turned off

### Tags Tab
- [x] Individual tag protections are turned off

### Rules/Rulesets Tab
- [x] The repository uses the current rulesets
- [x] If appropriate, global rules are enabled/disabled for the repo

### Actions Tab
**If actions are enabled**:
- [x] Codecov is enabled on the repository
- [x] Title check is enabled
- [x] DCO check is enabled

### Webhooks Tab
- [x] All webhooks present are needed and in use
- [x] Snyk is enabled on the repo (check to see if the webhook exists and is in use)

### Code Security Tab
- [x] Dependabot is enabled on the repository

### Secrets and Variables Tab
- [x] GitHub secrets are employed to store sensitive data
- [x] Tokens are stored securely as GitHub Secrets

### GitHub Apps
- [ ] Code Coverage Reporting
- [x] CodeQL is enabled on the repository
- [x] Codacy is enabled on the repository

## App Integrations
- [x] Dependabot is configured to monitor all relevant ecosystems (verify through `dependabot.yaml` file)
- Link to [relevant ecosystems](https://docs.github.com/en/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories)
- [x] DCO-2 is configured as the DCO check

## Code Formatting
- [ ] NodeJS Projects use ESLint/Prettier formatting
- [x] Java Projects use Checkstyle/Spotless formatting
- [ ] CPP Projects use Clang Tidy
- [ ] Rust
- [ ] Swift
- [ ] Go

## CODEOWNERS
- [x] `.github/CODEOWNERS` is valid and up-to-date

# Workflow Audit Criteria

## Security Checks in Workflows
- [x] Secrets Management In Workflow Files (`/.github/workflows/`)
- [x] No hardcoded secrets in the workflow files or code
- [x] Secrets are referenced in CI via config files or environment variables
- [ ] Executable Path Integrity
- [ ] Integrity checks for executables are implemented
- integrity checks should use either checksums or cryptographic hashes for verification
- [ ] Checksums/hashes are verified during CI process to detect unauthorized changes
- [ ] Expected checksums/hashes are stored securely and referenced through the CI pipeline
- [ ] Use pinned versions of Docker files
- [ ] `npx playwright install deps` is used to install OS dependencies instead of `aptitude`

## Workflow checks

- [x] Appropriate permissions are set within the GitHub workflows
- [x] All steps are named
- [x] All workflow actions are using pinned commits
- [x] The step-security hardened security action is enabled on each workflow job
- [x] If the step-security dashboard reports action with score of <6, request a step-security version of the action

## Self Hosted Runners

- [x] The Repository is using the latitude runner group label for the `runs-on` stanza

## Other

- [ ] *If Applicable*: Alert repository owners of software versions that are no longer supported
- [ ] *If Applicable*: Alert repository owners when software versions are within 3 months of losing support

---

## Acceptance Criteria

- [x] All Audit Criteria have been met
- [ ] Inactive Repo (>1 year since last significant commit)
- [ ] Empty Repo

## Custom Properties - Marking Complete

Update the `repo-properties.json` file in the `ORG/governance` repository

- [x] Custom properties: `initial-ci-review-by-team` is set
- [x] Custom properties: `initial-ci-review-date` is set (Use format: `YYYY-MM-DD`)
- [x] Custom properties: `last-ci-review-by-team` is set
- [x] Custom properties: `last-ci-review-date` is set (Use format: `YYYY-MM-DD`)

*Note: assumes `ORG/governance` is a valid repository in the Github Organization being audited*

Start by reviewing .github/workflows/, dependabot.yaml, and .github/CODEOWNERS, then inspect the repository settings and the listed GitHub integrations. Compare each unchecked audit item with the repository state and governance requirements. Done means applicable criteria are satisfied, the acceptance checklist is complete, and the required repo-properties.json entries remain updated.

Written by the indexing model from the issue text.