ci: add Dependabot and security checks

[lemarier]

Change

Adopt the Dependabot and security baseline from origin89hq/engineering#28. Dependabot opens weekly PRs grouping minor and patch updates per ecosystem, with majors as separate PRs and a 7-day cooldown. It covers GitHub Actions at / and /.github/actions/setup-node, and npm (pnpm) at /. Nothing auto-merges.

origin89-security runs dependency review on pull requests and a zizmor audit of the workflows on pull requests, pushes to main, and a weekly schedule. There is no Cargo workspace, so the cargo-deny job is omitted.

The seven-day cooldown is the minimum zizmor 1.30.1 accepts, so no cooldown ignore is needed; security updates are not delayed.

Validation

• uvx zizmor@1.30.1 --offline --min-severity medium .github/: no findings. Without .github/zizmor.yml, the dependabot-cooldown audit flags each 7-day cooldown as below its 7-day default.
• actionlint: clean on all workflows.
• Parsed dependabot.yml and the new workflow as YAML.

origin89-security runs on this PR. Dependabot reads its config from the default branch, so update PRs start after merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T12:04:05.048779Z	3cd65ac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Advanced

Run ID: 5a3e09ce-250f-4fcc-8462-3581611fce64

📥 Commits

Reviewing files that changed from the base of the PR and between b959851 and 8252a89.

📒 Files selected for processing (3)

• .github/actions/setup-node/action.yml
• .github/dependabot.yml
• .github/workflows/origin89-security.yml

Limit details: You’ve used all 10 included reviews currently available.

---

📝 Walkthrough

Walkthrough

The pnpm action reference now uses a different pinned commit. Dependabot is configured for weekly GitHub Actions and npm updates, with a seven-day cooldown and grouped minor and patch updates. A new security workflow runs dependency review on pull requests and zizmor on pushes to main, pull requests, and a weekly schedule.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 8252a

The dependency-update configuration and security workflow have no established merge-blocking issue. The change is ready for normal merge checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 8252a

The new checks use limited permissions and improve coverage, but the dependency gate may not fail for dependencies classified with an unknown scope. Whether that classification occurs here remains unverified.

Retained concerns

• Low · security · inferred: The new pull-request gate would not fail a moderate-or-higher-severity dependency change if dependency-review classified it with the omitted unknown scope. That classification has not been demonstrated for this repository, and no equivalent gate existed on main.

Security review details

Security Blast Radius

• inferred — The possible scope gap affects this repository's pull-request dependency check. The supplied evidence does not show application-runtime, tenant, or credential exposure from the new jobs.

Security Findings and Attack Paths

• inferred — A pull request adding a vulnerable dependency could avoid this job's failure condition if the dependency receives an unknown scope. No actual unknown-scoped change or successful bypass has been established; the candidate remains deferred.

Trust Boundaries and Controls

• observed — Pull-request content enters the security jobs through checkout; the jobs have read-only contents permission and do not persist checkout credentials. Dependency review is the pull-request-only enforcement step.

Hardening Proposals

• proposed — If the intended policy is to fail on every dependency scope the action recognizes, include unknown in the failure scopes and verify the behavior against an actual dependency-review result.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main changes: adding Dependabot configuration and security checks.
Description check	✅ Passed	The description directly explains the Dependabot configuration, security workflow, omitted cargo-deny job, and validation results.

---

_{Comment @coderabbitai help to get the list of available commands.}