From 3396eb1c97603c2ec5f1b1e8e29db316c79440a6 Mon Sep 17 00:00:00 2001
From: forkwright <cody@forkwright.com>
Date: Tue, 25 Aug 2026 12:01:00 -0500
Subject: [PATCH] ci(security): add the CodeQL and dependency-update wiring
 this repo lacked

Nothing was reading this repo's source for injection paths, unsafe patterns, or
over-broad workflow permissions. cargo audit, cargo deny and OSV all read the
dependency list rather than the code, so a defect written here was never scanned.

Dependabot coverage matters for the same reason its absence is quiet: a repo with
no config receives no update PRs at all, and the symptom is silence rather than a
failing job.

Scope follows what the repo actually is rather than a uniform template. A repo
with no Cargo manifest gets the workflow-definition scan only -- a Rust scan
there fails looking for a build, on every push, forever -- and its dependabot
config declares only the ecosystems it uses.

Every CodeQL job carries a timeout. Without one a hung run reaches GitHub's
six-hour default, which is the failure nobody notices until it has been burning
minutes all afternoon, and it is the specific thing the fleet template omits.

The checkout pin matches what this repo's own workflows already use rather than
the newest available, because introducing a second version of one action into a
repo is the drift this wiring exists to catch.

Scheduled weekly rather than per-PR, so it adds no latency to the merge path.
---
 .github/dependabot.yml       | 10 +++++++++
 .github/workflows/codeql.yml | 39 ++++++++++++++++++++++++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..415ca41
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        update-types: [minor, patch]
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..e46d466
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,39 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 14 * * 3" # Wednesday 08:00 CST
+
+# PROJECT: explicit top-level default deny; job-level permissions grant only what's needed
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze-actions:
+    name: Analyze (actions)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false # PROJECT: security hardening — never expose token to steps
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
+        with:
+          languages: actions
+          queries: +security-extended
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
+        with:
+          category: /language:actions