Add security policy and improve supply chain security

.github/htmlhint/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "hugo-template-htmlhint",
+  "private": true,
+  "description": "Pinned HTMLHint install for .github/workflows/quality.yml. Not part of the site.",
+  "dependencies": {
+    "htmlhint": "1.9.2"
+  }
+}

.github/workflows/quality.yml

@@ -65,17 +65,21 @@ jobs:
         with:
           node-version: 'lts/*'
 
+      # `npm ci` against a checked-in package-lock.json (.github/htmlhint/),
+      # rather than `npm install -g htmlhint@version`: the latter resolves
+      # through the registry at run time with nothing to verify what comes
+      # back against, which is what Scorecard's Pinned-Dependencies check and
+      # zizmor's adhoc-packages audit both flag it for. `npm ci` installs
+      # exactly what the lockfile's integrity hashes say, and bumping the
+      # version is a normal Renovate PR against that lockfile.
       - name: Install HTMLHint
-        env:
-          # renovate: datasource=npm depName=htmlhint
-          HTMLHINT_VERSION: "1.9.2"
-        run: npm install -g "htmlhint@${HTMLHINT_VERSION}"
+        run: npm ci --prefix .github/htmlhint
 
       # HTMLHint: structural errors, missing attributes, accessibility. Runs on
       # the built output, not on the templates: a Hugo layout is not a
       # standalone HTML document, so linting one only produces noise.
       - name: Check HTML
-        run: htmlhint "src/public-lint/**/*.html"
+        run: .github/htmlhint/node_modules/.bin/htmlhint "src/public-lint/**/*.html"
 
       # Installed by hand rather than through lycheeverse/lychee-action, which
       # fetches its binary with a bare `curl -sfLO`: no retry, and no check on

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported versions
+
+This is a template repository, not a versioned library — there is no
+release history to track. The `main` branch is the only supported state;
+sites created from this template inherit whatever `main` looked like at
+the time they were generated and are responsible for their own updates
+afterwards.
+
+## Reporting a vulnerability
+
+If you find a security issue in this template (for example: an XSS vector
+in a layout, a workflow that leaks secrets, or a supply-chain issue in a
+pinned dependency), please report it privately rather than opening a
+public issue.
+
+Use GitHub's [private vulnerability reporting](https://github.com/THectic-NL/hugo-template/security/advisories/new)
+for this repository. You should get an initial response within a few
+business days.
+
+Please do not report vulnerabilities in Hugo itself, or in third-party
+Actions/npm packages this template depends on — report those upstream.

renovate.json

@@ -25,6 +25,7 @@
   "minimumReleaseAge": "7 days",
   "enabledManagers": [
     "github-actions",
+    "npm",
     "custom.regex"
   ],
   "customManagers": [
@@ -56,7 +57,8 @@
     {
       "description": "Hugo, actionlint, HTMLHint and lychee. Not automerged: some are pinned alongside a checksum, and update-checksums.yml has to push the recalculated hash onto the branch first.",
       "matchManagers": [
-        "custom.regex"
+        "custom.regex",
+        "npm"
       ],
       "groupName": "Build tooling versions",
       "addLabels": [