Repo hygiene: SECURITY.md, pinned actions, uniform project.urls

.github/workflows/release.yml

@@ -106,4 +106,4 @@ jobs:
           name: dist
           path: dist/
       - name: Publish via Trusted Publishing
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3

SECURITY.md

@@ -0,0 +1,18 @@
+# Security policy
+
+## Supported versions
+
+Security fixes land on the latest release. Earlier releases are not
+maintained.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub's advisory form:
+
+<https://github.com/wolph/python-progressbar/security/advisories/new>
+
+That keeps the report out of the public issue tracker until a fix is
+available. If you cannot use the form, mail <Wolph@Wol.ph> instead.
+
+Please include the progressbar2 version, the configuration that triggers the
+issue and a minimal reproduction. Expect an acknowledgement within a week.

pyproject.toml

@@ -114,6 +114,7 @@ bugs = 'https://github.com/wolph/python-progressbar/issues'
 documentation = 'https://progressbar-2.readthedocs.io/en/latest/'
 repository = 'https://github.com/wolph/python-progressbar/'
 Funding = 'https://github.com/sponsors/wolph'
+Changelog = 'https://github.com/wolph/python-progressbar/releases'
 
 [project.scripts]
 progressbar = 'progressbar.__main__:main'