Cursor rule

1---
2description: GitHub Actions CI/CD conventions for whatsapp-verify
3globs: ".github/**"
4alwaysApply: false
5---
6 
7# GitHub Actions Standards
8 
9- Default permissions must be `read-all`; escalate per-job only as needed.
10- Use `step-security/harden-runner` in build jobs.
11- Pin all action versions by **full commit SHA**, not tags.
12- Use concurrency groups to cancel in-progress runs on the same branch.
13 
14# Build Workflow
15 
16- Java 25 with `temurin` distribution.
17- Cache Maven dependencies via `actions/setup-java` cache option.
18- Run `dependency-review-action` on pull requests.
19- Build native image, run tests, then run the binary's help command as a smoke test.
20 
21# Security
22 
23- CodeQL analysis runs after build for Java.
24- Dependency snapshots submitted via `maven-dependency-submission-action`.
25- Renovate manages dependency updates (`renovate.json`).
26- Pre-commit hooks enforce secrets scanning (`rh-pre-commit`), editorconfig, trailing whitespace, and YAML/JSON validation.
27