fix: harden CI workflow security, add project.urls, add ruff dep, add .gitattributes (#23)

- Add persist-credentials:false to all 5 checkout steps across 4 workflows
- Add permissions: contents:read to ci.yml (principle of least privilege)
- Use pip install -e .[dev] for lint step instead of separate pip install ruff
- Add ruff>=0.4.0 to dev dependencies in pyproject.toml
- Convert inline urls to [project.urls] table with Documentation, Issues, Changelog
- Add .gitattributes for consistent line endings across platforms

Co-authored-by: DevForge Engineer <engineer@devforge.dev>

Author: Coding-Dev-Tools

.gitattributes

@@ -0,0 +1,5 @@
+* text=auto eol=lf
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf
+*.vbs text eol=crlf

.github/workflows/ci.yml

@@ -6,19 +6,24 @@ on:
   pull_request:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: "3.12"
 
-      - name: Install ruff
-        run: pip install ruff
+      - name: Install dependencies
+        run: pip install -e ".[dev]"
 
       - name: Run ruff check
         run: ruff check .
@@ -32,6 +37,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065

.github/workflows/npm-publish.yml

@@ -15,6 +15,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020

.github/workflows/pages.yml

@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
       - name: Setup Pages
         uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b
       - name: Build with Jekyll

.github/workflows/publish.yml

@@ -22,6 +22,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.12
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065

pyproject.toml

@@ -10,7 +10,6 @@ readme = "README.md"
 requires-python = ">=3.10"
 license = "MIT"
 authors = [{name = "Revenue Holdings"}]
-urls = {Homepage = "https://github.com/Coding-Dev-Tools/datamorph", Repository = "https://github.com/Coding-Dev-Tools/datamorph"}
 keywords = ["data-converter", "csv", "json", "yaml", "parquet", "avro", "etl", "cli"]
 classifiers = [
     "Development Status :: 4 - Beta",
@@ -32,10 +31,18 @@ dependencies = [
     "fastavro>=1.12.2",
 ]
 
+[project.urls]
+Homepage = "https://github.com/Coding-Dev-Tools/datamorph"
+Documentation = "https://coding-dev-tools.github.io/datamorph/"
+Repository = "https://github.com/Coding-Dev-Tools/datamorph"
+Issues = "https://github.com/Coding-Dev-Tools/datamorph/issues"
+Changelog = "https://github.com/Coding-Dev-Tools/datamorph/releases"
+
 [project.optional-dependencies]
 dev = [
     "pytest>=9.0.3",
     "pytest-cov>=7.1.0",
+    "ruff>=0.4.0",
 ]
 full = [
     "protobuf>=7.34.1",
@@ -56,4 +63,4 @@ select = ["E", "F", "W", "I"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-python_files = ["test_*.py"]
+python_files = ["test_*.py"]