Add automated dependency and code scanning (Dependabot, pip-audit, CodeQL)

[dgenio]

Summary

Introduce supply-chain and static-analysis automation: Dependabot (or equivalent)
for pip and GitHub Actions version updates, a pip-audit step in CI for known-vuln
detection in the dependency tree, and CodeQL scanning for the Python source.

Why this matters

A security kernel is held to a higher supply-chain standard than the average
library: adopters will (and should) check whether the project scans itself. The
runtime dependency set is admirably small (httpx, pydantic), but extras pull in
larger trees (mcp, otel, yaml, tiktoken), CI actions are a moving dependency, and
none of it is monitored today. These are low-effort, high-signal controls that also
future-proof releases (a known-vulnerable pin caught before publish, not after).

Current evidence

• No .github/dependabot.yml; no pip-audit/CodeQL/security-scanning workflow exists (only ci.yml and publish.yml).
• ci.yml uses floating action tags (actions/checkout@v4) — update automation pairs with pinning (ISSUE 56).
• pyproject.toml extras: mcp, otel, policy, tiktoken — real third-party trees beyond the minimal core.

External context

Dependabot/pip-audit/CodeQL are the standard GitHub-native security baseline (OpenSSF
Scorecard checks measure exactly these).

Proposed implementation

1. .github/dependabot.yml: weekly pip (with grouped minor/patch updates to limit
   noise) + github-actions ecosystems.
2. CI step (or separate workflow): pip-audit over the dev environment; decide
   policy for failures (block on HIGH+, warn otherwise) and document it.
3. CodeQL workflow with the Python query pack on PRs + schedule.
4. Document the security automation in SECURITY.md when [Community] Add issue templates, SECURITY.md, CODE_OF_CONDUCT, and a curated good-first-issue set #144 lands (or in README
   until then) — neutral wording.

AI-agent execution notes

• Inspect first: .github/workflows/, pyproject.toml (extras and pins), open issue [Community] Add issue templates, SECURITY.md, CODE_OF_CONDUCT, and a curated good-first-issue set #144 (community files) to avoid duplicating its SECURITY.md scope.
• Library-grade constraints matter (packaging: support Python 3.10–3.14 (inclusive) + library-grade dependency constraints (no forced version pins) #113): Dependabot config should respect ranged deps, not force pins on the library itself (it updates lockless CI/dev usage).
• Edge cases: pip-audit false positives (allowlist mechanism documented); CodeQL noise triage.
• Keep workflows minimal-permission (permissions: blocks — pairs with ISSUE 56).

Acceptance criteria

• Dependabot opens grouped update PRs for pip and actions ecosystems.
• CI fails (per documented policy) on known-vulnerable dependencies.
• CodeQL runs on PRs and a schedule with the Python pack.

Test plan

Verify first Dependabot PRs, a seeded pip-audit failure in a branch, and a CodeQL
run completing. Run make ci.

Documentation plan

README security section note (until SECURITY.md exists via #144); CHANGELOG Added (CI).

Migration and compatibility notes

Not expected to require migration.

Risks and tradeoffs

Update-PR noise (grouping mitigates); CodeQL minutes on a small repo are negligible.
Failure-policy tuning needs one iteration to avoid blocking unrelated work.

Suggested labels

security, reliability, contributor-experience

[dgenio]

Closing as completed — all three controls are now in main (landed via the CI-hardening work in #234, commit d2236cb):

• Dependabot: .github/dependabot.yml configures weekly pip (grouped minor/patch) and github-actions updates.
• pip-audit: .github/workflows/ci.yml has a security-audit job that resolves the runtime dependency tree in an isolated venv and runs pip-audit --strict (fail on any known vuln).
• CodeQL: .github/workflows/codeql.yml runs the security-and-quality Python query pack on push/PR + a weekly schedule.

The security automation is documented in the README per the issue's note. If you'd like to additionally raise pip-audit's failure policy (e.g. block on HIGH+ only) or add SARIF upload, that's worth a separate focused issue.

---

Generated by Claude Code