Add dependency and security automation

Add Dependabot coverage for Python dependencies and GitHub Actions.

Add a portable pre-commit configuration for Ruff, Bandit, and detect-secrets, and document local use.

Add a dedicated CodeQL workflow with a stable codeql check name for branch protection.

Validation: .venv/bin/pre-commit run --all-files; .venv/bin/ruff check .; .venv/bin/bandit -c pyproject.toml -r src; git ls-files -z | xargs -0 .venv/bin/detect-secrets-hook --baseline .secrets.baseline; PYTHONPATH=src python3 -m unittest discover -s tests; python3 -m compileall -q src tests.

Author: rgerhards

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:00"
+      timezone: "Europe/Berlin"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "python"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "04:30"
+      timezone: "Europe/Berlin"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"

.github/workflows/codeql.yml

@@ -0,0 +1,30 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "32 4 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  codeql:
+    name: codeql
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: python
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4

.pre-commit-config.yaml

@@ -0,0 +1,20 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.14.8
+    hooks:
+      - id: ruff-check
+
+  - repo: local
+    hooks:
+      - id: bandit
+        name: bandit
+        entry: bandit -c pyproject.toml -r src
+        language: python
+        pass_filenames: false
+        additional_dependencies: ["bandit[toml]==1.8.6"]
+
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: ["--baseline", ".secrets.baseline"]

README.md

@@ -59,6 +59,13 @@ PYTHONPATH=src python3 -m unittest discover -s tests
 python3 -m compileall -q src tests
 ```
 
+Optional local pre-commit checks use the same installed development tools:
+
+```bash
+.venv/bin/pre-commit install
+.venv/bin/pre-commit run --all-files
+```
+
 Plugins can run on independent schedules by setting `interval_seconds` on each
 `[[plugins]]` entry. If omitted, the global `poll_interval_seconds` is used.
 Set `interval_seconds = 0` to run a plugin every scheduler cycle.

requirements-dev.txt

@@ -1,3 +1,4 @@
 bandit[toml]==1.8.6
 detect-secrets==1.5.0
+pre-commit==4.6.0
 ruff==0.14.8