ci: add Dependabot and security checks

[lemarier]

Change

Adds .github/dependabot.yml and .github/workflows/origin89-security.yml from the templates in origin89hq/engineering#28. Dependabot checks GitHub Actions and the Python requirements weekly, groups minor and patch updates per ecosystem, opens majors separately, and waits seven days after a release (zizmor 1.30.1 rejects shorter cooldowns). People review and merge every update; nothing auto-merges.

requirements-dev.txt is compiled from requirements-dev.in with uv pip compile --universal --python-version 3.12 --generate-hashes. Dependabot's pip ecosystem would rerun it with pip-tools, which has no universal mode, so this uses the uv ecosystem. That updater takes --universal and --python-version from the compiled file's header, so the file now keeps uv's header and CONTRIBUTING.md drops --no-header. Regenerating left every pin and hash unchanged; the diff adds only the two header lines.

The security workflow runs dependency review on pull requests and a zizmor audit of the workflows on pull requests, pushes to main, and a weekly schedule. The cargo-deny job is omitted because the repository has no Cargo workspace.

Validation

• uv pip compile requirements-dev.in --python-version 3.12 --generate-hashes --universal -o requirements-dev.txt (uv 0.11.29): only the header lines changed.
• uvx zizmor@1.30.1 --offline --min-severity medium .github/: no findings.
• actionlint: clean.
• uvx check-jsonschema --builtin-schema vendor.dependabot .github/dependabot.yml: valid.
• just check was not run locally; the header lines are comments and do not affect pip install --require-hashes. The new workflow's first run is on this PR, and no Dependabot uv update has run against this file yet.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T12:07:28.564577Z	17eee25	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

📝 Walkthrough

Walkthrough

Adds weekly Dependabot updates for GitHub Actions and uv, with grouped minor and patch updates. Adds a GitHub Actions workflow for pull-request dependency review and zizmor analysis. Updates the dependency compilation instructions and generated file comments to retain and describe the generated header.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: 🟡 Moderate · up to 4e8d6

Python dependency updates may not be generated as intended. Confirm that Dependabot supports these files before merging, or explicitly accept that uncertainty.

Architecture Summary

Architecture risk: 🔵 Low · up to 4e8d6

The change affects 2 systems.

Changed systems: CONTRIBUTING.md, requirements-dev.txt

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — CONTRIBUTING.md (service) was modified; 1 changed file maps to changed impact.
• observed — requirements-dev.txt (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in CONTRIBUTING.md: The compile command no longer suppresses the generated header, and the instructions now require retaining it for Dependabot to read the compile options.
• observed — Modified behavior in requirements-dev.txt: Added comments declaring that the file was generated by uv using requirements-dev.in, targeting Python 3.12 with hashes and universal resolution.
• observed — Modified behavior in .github/dependabot.yml: Adds weekly Dependabot update configuration for GitHub Actions and uv at /, with a 7-day default cooldown and groups covering all minor and patch updates. Sets commit-message prefixes to ci for GitHub Actions and chore for uv, with scope included for uv; comments describe the requirements compilation workflow.
• observed — Modified behavior in .github/workflows/origin89-security.yml: Adds the workflow triggers, read-only contents permission, and a pull-request-only dependency review job. The job fails on moderate-or-higher severity findings in runtime or development dependencies and allows the specified licenses; unknown licenses are reported without failing.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description explains the problem, changes, dependency and automation behavior, validation results, and unperformed checks. It does not use the template's exact heading or validation table, but it …
Title check	✅ Passed	The title clearly summarizes the main changes: adding CI-related Dependabot configuration and security checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Usage-based review receipt

• Mode: Continue automatically
• Reviewed files: 4
• Waived: $1.00 (charged $0.00)
• View usage details

Note

This review exceeded your plan’s limits and used usage-based reviews—free during trial, billed after paid activation unless disabled. Manage usage-based reviews.

---

_{Comment @coderabbitai help to get the list of available commands.}

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

.github/dependabot.yml-20-20 (1)

20-20: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Configure Dependabot for the repository's dependency files.

The uv Dependabot integration updates uv.lock. This repository has no uv.lock; it uses requirements-dev.in and requirements-dev.txt. The generated header does not make this pair a uv input. Use an updater that supports this pair or migrate to a supported manifest and lockfile.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Advanced

Run ID: 2f3d1494-5ed0-4332-98ab-525fb71c3911

📥 Commits

Reviewing files that changed from the base of the PR and between 0f464c3 and 4e8d6bb.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/origin89-security.yml
• CONTRIBUTING.md
• requirements-dev.txt

Limit details: You’ve used all 10 included reviews currently available.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 17eee253a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Run a dependency scanner on scheduled events

On a scheduled run, this condition unconditionally skips dependency-review; the only remaining job is zizmor, which audits workflow definitions rather than the packages pinned in requirements-dev.txt. Consequently, a vulnerability disclosed after a dependency was merged is not evaluated by the weekly run despite the schedule's stated purpose. Add a scheduled vulnerability scanner for the existing lock file, or otherwise remove the misleading advisory coverage.

Useful? React with 👍 / 👎.