ci: add Dependabot and security checks

[lemarier]

Change

Adopt the Dependabot and security baseline from origin89hq/engineering#28. Dependabot opens weekly PRs grouping minor and patch updates per ecosystem, with majors as separate PRs and a 7-day cooldown. It covers GitHub Actions at / and /.github/actions/setup-node, and npm (pnpm) at /. Nothing auto-merges.

origin89-security runs dependency review on pull requests and a zizmor audit of the workflows on pull requests, pushes to main, and a weekly schedule. There is no Cargo workspace, so the cargo-deny job is omitted.

The seven-day cooldown is the minimum zizmor 1.30.1 accepts, so no cooldown ignore is needed; security updates are not delayed.

Validation

• uvx zizmor@1.30.1 --offline --min-severity medium .github/: no findings. Without .github/zizmor.yml, the dependabot-cooldown audit flags each 7-day cooldown as below its 7-day default.
• actionlint: clean on all workflows.
• Parsed dependabot.yml and the new workflow as YAML.

origin89-security runs on this PR. Dependabot reads its config from the default branch, so update PRs start after merge.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-27T12:05:03.781637Z	ccc2c51	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

📝 Walkthrough

Walkthrough

Dependabot now checks GitHub Actions and npm updates weekly, groups minor and patch updates, and applies a seven-day cooldown. The new origin89-security workflow runs dependency review on pull requests and zizmor on pushes to main, pull requests, and weekly scheduled triggers.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely identifies the two main changes: Dependabot configuration and security checks.
Description check	✅ Passed	The description includes the required Change and Validation sections. It explains the configuration, scope, omitted cargo-deny job, validation commands, results, and rollout behavior.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

Quiet mode is enabled, so only the most important comments were posted inline. Other review comments are grouped below.

🟡 Other comments (1)

.github/workflows/origin89-security.yml-27-27 (1)

27-27: 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🟡 Minor | ⚡ Quick win

Security Misconfiguration

Reachability: External
CWE: CWE-693

Include unknown in fail-on-scopes.

unknown is a supported dependency scope. A moderate-or-higher vulnerability with that scope will not fail this check while the list contains only runtime, development.

Update the scope list

-          fail-on-scopes: runtime, development
+          fail-on-scopes: runtime, development, unknown

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: QUIET

Plan: Advanced

Run ID: 4dfcc30e-4fd8-4918-98be-d9f98d1598c7

📥 Commits

Reviewing files that changed from the base of the PR and between 3a274c7 and 8cb464f.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/origin89-security.yml

Limit details: You’ve used all 10 included reviews currently available.