fix(ci): address CI/CD security gaps from audit

.gitignore

@@ -50,3 +50,19 @@ target/typescript-axios-webpack-module-federation-openapi-generator-*-tests*
 
 .claude/worktrees
 .claude/settings.local.json
+
+# Security-sensitive files — prevent accidental secret commits
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+*.cert
+*.p12
+*.pfx
+*.jks
+credentials.json
+sa-key.json
+service-account*.json
+**/secrets/
+*.secret

.husky/pre-commit

@@ -0,0 +1 @@
+npm test

.npmignore

@@ -3,3 +3,38 @@
 *.spec.*
 __snapshots__/
 __mocks__/
+
+# Config files — not needed in published packages
+tsconfig*.json
+jest.config.*
+jest.integration.*
+project.json
+eslint.config.*
+.eslintrc*
+.prettierrc*
+typedoc.json
+
+# Source and docs — dist contains compiled output
+src/
+doc/
+docs/
+*.md
+!README.md
+
+# OpenAPI specs — consumers don't need raw specs
+openapi*.json
+openapi*.yaml
+openapi*.yml
+
+# CI/CD and tooling
+.github/
+.husky/
+.nx/
+.vscode/
+
+# Security — never publish credentials or env files
+.env
+.env.*
+*.pem
+*.key
+*.secret

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest published version of each `@redhat-cloud-services/*-client` package receives security updates. Upgrade to the latest version to ensure you have all fixes.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it responsibly:
+
+1. **Do NOT open a public GitHub issue** for security vulnerabilities.
+2. Report via [Red Hat Product Security](https://access.redhat.com/security/team/contact/) or email `secalert@redhat.com`.
+3. Include a description of the vulnerability, steps to reproduce, and any relevant logs or screenshots.
+
+You should receive a response within 5 business days. We will work with you to understand and address the issue before any public disclosure.
+
+## Security Practices
+
+This project follows these security practices:
+
+- **Pinned dependencies**: GitHub Actions use commit SHA pinning to prevent supply chain attacks.
+- **CODEOWNERS protection**: CI/CD configuration, git hooks, package manifests, and npm configuration require admin review.
+- **Signed releases**: Release commits and tags are GPG-signed.
+- **npm provenance**: Published packages include [provenance attestations](https://docs.npmjs.com/generating-provenance-statements) for supply chain transparency.
+- **Automated dependency updates**: Renovate monitors for outdated and vulnerable dependencies.
+- **Pre-commit hooks**: Husky enforces test execution and commit message validation before every commit.
+- **Least-privilege CI**: PR workflows run with read-only permissions; write access is scoped to the release job only.
+- **Conventional commits**: Commitlint enforces structured commit messages to maintain a clear audit trail.

package.json

@@ -25,7 +25,9 @@
     "build:no-cache": "npm run build -- --skip-nx-cache",
     "generate": "nx run-many -t generate --exclude=@redhat-cloud-services/CLIENTNAME-client",
     "lint": "nx run-many -t lint --exclude=@redhat-cloud-services/CLIENTNAME-client",
-    "lint:fix": "nx run-many -t lint --fix --exclude=@redhat-cloud-services/CLIENTNAME-client"
+    "lint:fix": "nx run-many -t lint --fix --exclude=@redhat-cloud-services/CLIENTNAME-client",
+    "audit": "npm audit",
+    "audit:fix": "npm audit fix"
   },
   "workspaces": [
     "packages/*"