From 941e12051fbe35dba491344d8208bfec818dbcd4 Mon Sep 17 00:00:00 2001
From: Thibaud-Vdb <thibaud@getplumber.io>
Date: Mon, 3 Aug 2026 10:12:35 +0200
Subject: [PATCH 1/2] ci: add plumber workflow security check

Scans the workflows on each push to main and on pull requests, and
fails when something regresses: an unpinned action, a job without a
permissions block, an archived dependency, a known CVE. The config
is a small overlay that inherits the CLI's built-in baseline and
turns off one control this repo cannot satisfy yet, with a comment
saying why. Each run publishes the score to score.getplumber.io,
shown as a badge in the README.
---
 .github/workflows/plumber.yml | 34 ++++++++++++++++++++++++++++++++++
 .plumber.yaml                 | 14 ++++++++++++++
 README.md                     |  1 +
 3 files changed, 49 insertions(+)
 create mode 100644 .github/workflows/plumber.yml
 create mode 100644 .plumber.yaml

diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml
new file mode 100644
index 00000000..40e8ec0b
--- /dev/null
+++ b/.github/workflows/plumber.yml
@@ -0,0 +1,34 @@
+name: Plumber
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+
+      - uses: getplumber/plumber@7ad9d267ee5a00163cec9e5c749a088d5f565167 # v0.4.26
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true
+          # Gate at 85 points instead of the all-or-nothing default,
+          # leaves room for a small finding without blocking PRs.
+          min-points: 85
diff --git a/.plumber.yaml b/.plumber.yaml
new file mode 100644
index 00000000..16ad4356
--- /dev/null
+++ b/.plumber.yaml
@@ -0,0 +1,14 @@
+# Plumber overlay: inherits every control from the CLI's built-in
+# baseline, only the differences for this repo are written here.
+# Run 'plumber config resolve' to see the full effective config.
+extends: plumber:default
+version: '2.0'
+
+github:
+  controls:
+    # Off for now: the release jobs restore the npm cache through
+    # setup-node on release triggers. Scoping the cache key to the
+    # release ref (or skipping the cache on publish) is a good
+    # follow-up, but it is its own change.
+    releaseWorkflowsMustNotRestoreUntrustedCache:
+      enabled: false
diff --git a/README.md b/README.md
index e8076b9c..c4d5545a 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # React Components for the Google Maps JavaScript API
 
 [![MIT License](https://img.shields.io/badge/license-MIT-green.svg)](https://github.com/visgl/react-google-maps/tree/main/LICENSE)
+[![Plumber Score](https://score.getplumber.io/github.com/visgl/react-google-maps.svg)](https://score.getplumber.io/github.com/visgl/react-google-maps)
 
 This is a TypeScript / JavaScript library to integrate the Maps JavaScript API
 into your React application.

From 6ce8b8a4ddfaf1e61015039c94455d17ddea19c3 Mon Sep 17 00:00:00 2001
From: Thibaud-Vdb <thibaud@getplumber.io>
Date: Wed, 12 Aug 2026 09:35:31 +0200
Subject: [PATCH 2/2] ci: update the plumber check to v0.4.36

Brings the check to the current release. Validated against the
combined state of this branch and the hardening PR in its final
shape, first party actions on tags and release-please pinned: the
score is a clean 100, the pinning control only looks at third party
actions so the tag policy costs nothing.
---
 .github/workflows/plumber.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml
index 40e8ec0b..67faa6ed 100644
--- a/.github/workflows/plumber.yml
+++ b/.github/workflows/plumber.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: getplumber/plumber@7ad9d267ee5a00163cec9e5c749a088d5f565167 # v0.4.26
+      - uses: getplumber/plumber@e81ed4965fd92e0d2b63e95d399ed0419f5de2fa # v0.4.36
         with:
           # Code scanning upload needs security-events write, which PRs
           # from forks do not get. The report stays available as a