chore(security): harden examples and refresh secure-default docs

.github/WORKFLOW_BASELINE.md

@@ -0,0 +1,32 @@
+# Workflow Baseline Policy
+
+This repository defines the organization-level baseline for GitHub collaboration and CI hygiene.
+
+## Reusable workflow reference policy
+
+- Do **not** reference reusable workflows with floating refs such as `@master` or `@main`.
+- Use immutable refs:
+  - pinned commit SHA (preferred), or
+  - immutable release tag.
+
+Example:
+
+```yaml
+uses: clouddrove/github-shared-workflows/.github/workflows/tf-checks.yml@88efd7724e007c8f721a219498be29e0c9ad471b
+```
+
+## Pull request baseline
+
+- Conventional Commit title required.
+- Semantic PR title check required.
+- CI checks must pass before merge.
+
+## Terraform module baseline (org standard)
+
+For Terraform module repositories, include:
+
+- `terraform.required_version` in `versions.tf`
+- explicit `required_providers` constraints
+- pinned shared workflow refs in `.github/workflows/*`
+
+These standards reduce supply-chain risk and improve CI reproducibility.

README.md

@@ -154,4 +154,4 @@ Write to us at [hello@clouddrove.com](hello@clouddrove.com).
 
   [email]: <>
   [github]: https://github.com/terraform-az-modules
-  [terraform_modules]: https://github.com/orgs/terraform-az-modules/repositories
+  [terraform_modules]: https://github.com/orgs/terraform-az-modules/repositories

examples/complete/example.tf

@@ -78,13 +78,13 @@ module "vault" {
   resource_group_name           = module.resource_group.resource_group_name
   location                      = module.resource_group.resource_group_location
   subnet_id                     = module.subnet.subnet_ids.subnet1
-  public_network_access_enabled = true
+  public_network_access_enabled = false
   sku_name                      = "premium"
   private_dns_zone_ids          = module.private_dns_zone.private_dns_zone_ids.key_vault
   network_acls = {
     bypass         = "AzureServices"
     default_action = "Deny"
-    ip_rules       = ["0.0.0.0/0"]
+    ip_rules       = []
   }
   reader_objects_ids = {
     "Key Vault Administrator" = {