fix: remediate dependency and workflow security alerts

.github/workflows/ci.yml

@@ -17,6 +17,9 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - os: ubuntu-latest
+            python-version: "3.10"
+            upload-coverage: false
           - os: ubuntu-latest
             python-version: "3.11"
             upload-coverage: true

.github/workflows/codeql.yml

@@ -9,7 +9,6 @@ on:
 
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
@@ -38,4 +37,4 @@ jobs:
         uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3.28.10
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3.28.10
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3.28.10

.github/workflows/release.yml

@@ -19,15 +19,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.3.0
         with:
           python-version: "3.12"
-          cache: pip
 
       - name: Install uv
         uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v3.1.5
+        with:
+          enable-cache: false
 
       - name: Create venv and install release tooling
         run: |
@@ -71,13 +74,13 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
-  publish:
-    name: Publish verified release artifacts
+  publish-pypi:
+    name: Publish verified release artifacts to PyPI
     needs: build
     runs-on: ubuntu-latest
     environment: release
     permissions:
-      contents: write
+      contents: read
       id-token: write
       attestations: write
 
@@ -96,19 +99,25 @@ jobs:
             dist/*.tar.gz
             dist/sbom.spdx.json
 
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.3.0
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
-          python-version: "3.12"
+          password: ${{ secrets.PYPI_API_TOKEN }}
 
-      - name: Install pinned publication tooling
-        run: python -m pip install --disable-pip-version-check twine==7.0.0
+  publish-github:
+    name: Publish verified release artifacts to GitHub
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+    permissions:
+      # Required to create the release and upload its assets.
+      contents: write
 
-      - name: Publish to PyPI
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-        run: python -m twine upload dist/*.whl dist/*.tar.gz
+    steps:
+      - name: Download verified artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: release-dist
+          path: dist
 
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v2

README.md

@@ -43,7 +43,7 @@ ingested and scored.
 
 Prerequisites:
 
-- Python 3.9+
+- Python 3.10+
 - Node.js 20+ for the optional web interface
 
 ```bash

pyproject.toml

@@ -10,7 +10,7 @@ authors = [
     { name = "ExploitRank Team" }
 ]
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = "AGPL-3.0-or-later"
 dependencies = [
     "typer>=0.12,<1",