add CI, repo security, and hygiene

[anandpant]

Summary

This PR adds the baseline repository automation that was missing after the initial package merge. The repo had Nx configured locally, but there were no GitHub workflows for basic quality gates, no repository security policy, and no dependency automation. That meant build, lint, and test status only existed on local machines, while GitHub security settings were mostly still disabled even though this repository is public and eligible for free protections.

The result was a gap between the local Nx setup and the actual repository posture. Contributors could merge changes without GitHub enforcing the same checks the workspace is already designed to run. Security reporting and supply-chain automation were also not discoverable from the repo itself.

Root Cause

The workspace had solid local Nx targets, but the GitHub-facing layer had not been wired up yet. There was no .github directory, no workflow generated from Nx, no SECURITY.md, no Dependabot config, and no README signal showing CI or DeepWiki indexing. There was also a caching correctness issue in the lint target: it linted root docs and workflow files, but Nx was not treating those files as lint inputs, so cache hits could become stale for repo-level changes.

Fix

The PR generates and then trims a GitHub Actions CI workflow around the existing Nx targets so PRs and pushes to main run lint, test, typecheck, and build for foundry-ai. It also adds a weekly Dependabot configuration for npm packages and GitHub Actions.

On the repository side, it adds a real security policy, updates the README to reflect current tool versions and CI status, and adds the lightweight DeepWiki badge link requested for auto-refresh/index pickup. It also updates the small set of viable dependency bumps in the workspace: nx, @nx/js, and ai.

The Nx configuration is tightened so repo-level files that are part of linting are also part of the lint cache inputs. That makes the new CI behavior defensible instead of depending on stale cache assumptions for docs and workflow changes.

Validation

I ran the full uncached Nx path on this branch:

• pnpm exec nx run-many -t lint test typecheck build --projects=foundry-ai --skipNxCache --outputStyle=static
• pnpm exec nx run foundry-ai:clean --outputStyle=static

I also enabled the free GitHub repository security features available to this public repository:

• private vulnerability reporting
• Dependabot security updates and automated security fixes
• secret scanning
• secret scanning push protection
• secret scanning non-provider patterns
• secret scanning validity checks
• allow_update_branch
• delete_branch_on_merge
• read-only default workflow token permissions
• main branch protection with the required CI check, 1 approving review, stale review dismissal, and conversation resolution

I did not run the live Foundry suite because it requires credentials and external service access.

---

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.