PLT-18405: Bump templated files

.github/CODEOWNERS

@@ -1 +1,6 @@
+# This file is managed by the templated-files-bot. Changes should be made at the following repository.
+# https://github.com/treasure-data/dependency-bots
+#
+# For further details about reusable workflows executed by this workflow, see the following repository.
+# https://github.com/treasure-data/backend-github-workflows
 * @treasure-data/integrations

.github/copilot-instructions.md

@@ -0,0 +1,39 @@
+# GitHub Copilot Security Instructions
+
+## General Security Guidelines
+
+* Do not hardcode sensitive information (passwords, API keys, tokens)
+* Sanitize all user inputs to prevent injection attacks
+* Use parameterized queries for database operations
+* Implement proper error handling without exposing sensitive details
+* Validate and sanitize all data before processing or storing
+* Use secure communication protocols (HTTPS, SSH) for data transmission
+* Implement proper access controls and authentication mechanisms
+
+## Code Review Checklist
+
+* Check for hardcoded credentials or sensitive data
+* Verify input validation and sanitization
+* Look for potential SQL injection vulnerabilities
+* Identify possible cross-site scripting (XSS) issues
+* Review error handling and logging practices
+* Examine file handling and uploads for security risks
+* Assess the use of third-party libraries and their versions
+
+## Security Best Practices
+
+* Use environment variables for sensitive configuration
+* Implement proper session management
+* Apply the principle of least privilege
+* Use secure random number generators for cryptographic operations
+* Implement proper password hashing and storage techniques
+* Regularly update dependencies and apply security patches
+* Use content security policies to mitigate XSS attacks
+
+## Commit Guidelines
+
+* Review all changes before committing
+* Use meaningful commit messages that describe security-related changes
+* Double-check for accidentally committed sensitive information
+* Consider using pre-commit hooks for automated security checks
+* Remember to adapt and expand these guidelines based on your specific project requirements and technologies used.

.github/workflows/ai-pr-review.yml

@@ -0,0 +1,27 @@
+# This file is managed by the templated-files-bot. Changes should be made at the following repository.
+# https://github.com/treasure-data/dependency-bots
+#
+# For further details about reusable workflows executed by this workflow, see the following repository.
+# https://github.com/treasure-data/backend-github-workflows
+
+name: AI PR Review
+'on':
+  pull_request:
+    types:
+    - opened
+    - ready_for_review
+    - synchronize
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+jobs:
+  ai-pr-review:
+    if: ${{ github.event.pull_request.draft == false && !endsWith(github.actor, '[bot]') && github.actor != 'td-actions-bot' && github.actor != 'td-scala-steward'}}
+    uses: treasure-data/backend-github-workflows/.github/workflows/ai-pr-review.yml@main
+    with:
+      action_name: ${{ github.workflow }}
+    secrets:
+      TD_LLM_WEBHOOK_AUTH_TOKEN: ${{ secrets.TD_LLM_WEBHOOK_AUTH_TOKEN }}
+    permissions:
+      contents: read
+      pull-requests: write

.github/workflows/dependency-review.yml

@@ -5,16 +5,29 @@
 # https://github.com/treasure-data/backend-github-workflows
 
 name: Dependency Review
-
-on:
+permissions:
+  contents: read
+  pull-requests: write
+'on':
   push:
-    branches: ['main', 'master']
+    branches:
+    - main
+    - master
   pull_request:
-    branches: ['main', 'master']
-
+    branches:
+    - main
+    - master
 jobs:
   dependency-review:
     uses: treasure-data/backend-github-workflows/.github/workflows/call-dependency-review.yml@main
     with:
-      working-directory: .
+      working-directory: '.'
+      maven-settings-directory: '.'
+      gradle-build-cmd: ./gradlew assemble -Dorg.gradle.jvmargs=-Xmx2048m
+      sbt-ignore-configs: ''
+      sbt-ignore-modules: ''
+      java-version: 11
+      java-distribution: temurin
     secrets: inherit
+    permissions:
+      contents: write