add CodeQL security scanning and Dependabot

.github/DEVELOPMENT.md

@@ -22,6 +22,18 @@ This page contains the steps to build and run the Syncfusion Toolkit for Blazor
     dotnet build ./Syncfusion.Blazor.Toolkit.slnx
     ```
 
+### Release sanity check (local)
+
+If you want to mimic what `.github/workflows/nuget-publish.yml` does on a release runner, pass `-p:ContinuousIntegrationBuild=true` so SourceLink and the package hash match what CI produces:
+
+```dotnetcli
+dotnet restore src/Syncfusion.Blazor.Toolkit.csproj -p:ContinuousIntegrationBuild=true
+dotnet build   src/Syncfusion.Blazor.Toolkit.csproj -c Release --no-restore -p:ContinuousIntegrationBuild=true
+dotnet pack    src/Syncfusion.Blazor.Toolkit.csproj -c Release --no-build -o nupkg -p:ContinuousIntegrationBuild=true
+```
+
+> **Note**: `dotnet pack` triggers a `BeforeBuild` target that runs `npm install` and `gulp blazor-toolkit-themes` if `src/wwwroot/styles/fluent.min.css` is absent. Make sure Node.js (LTS) is on `PATH`. The release workflow installs Node 22 explicitly to handle this.
+
 ## Running Samples
 
 - Open the `samples/Blazor.Toolkit.Samples.slnx` file in Visual Studio.

.github/SECURITY.md

@@ -58,4 +58,4 @@ On a **monthly cadence** (targeting the second Wednesday of each month), the mai
 
 This project maintains a current security reference in the repository's [THREAT-MODEL.md](../THREAT-MODEL.md) document. The project team has reviewed the current architecture, package surface, and release flow and has documented the principal risks and mitigations in good faith.
 
-This attestation reflects the project’s current understanding as of 2026-08-12 and is intended to be updated as the toolkit evolves.
+This attestation reflects the project’s current understanding as of 2026-08-21 and is intended to be updated as the toolkit evolves.

.github/THREAT-MODEL.md

@@ -129,6 +129,10 @@ This threat model should be reviewed when:
 
 ## Self-attestation
 
-This threat model was prepared as a current security reference for the Syncfusion Blazor Toolkit project and reflects the maintainers’ understanding of the project as of 2026-08-12. The project team intends to review and update this document as changes to the component library, assets, or build pipeline occur.
+This threat model was prepared as a current security reference for the Syncfusion Blazor Toolkit project and reflects the maintainers’ understanding of the project as of 2026-08-21. The project team intends to review and update this document as changes to the component library, assets, or build pipeline occur.
 
 The maintainers attest that the information provided here is a good-faith assessment of the project’s current security risks and mitigations based on the repository structure and package design at the time of publication.
+
+### Change since last review
+
+- **2026-08-21 — Hardened CD pipeline for nuget-publish.** Added SLSA build provenance attestation (`actions/attest-build-provenance`), deterministic builds via `ContinuousIntegrationBuild=true`, exit-code-driven vulnerability scan with downloadable `vuln-report` artifact, and concurrency guard for re-tagged same-version pushes. Accepted-risks entries AR-1 and AR-2 were reviewed and remain applicable; no new accepted risk was introduced.

.github/dependabot.yml

@@ -0,0 +1,40 @@
+version: 2
+updates:
+  # NuGet packages (.NET)
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "nuget"
+    commit-message:
+      prefix: "deps(nuget)"
+
+  # npm (gulp, Playwright, etc.)
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "npm"
+    commit-message:
+      prefix: "deps(npm)"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "deps(actions)"

.github/workflows/ci.yml

@@ -0,0 +1,261 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  # =========================================================
+  # Job 1: bUnit (matrix)
+  # =========================================================
+  bunit:
+    name: bUnit (.NET ${{ matrix.dotnet-version }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    env:
+      TZ: UTC
+      LANG: en_US.UTF-8
+
+    strategy:
+      fail-fast: false
+      matrix:
+        dotnet-version: ['8.0.x', '9.0.x', '10.0.x']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET ${{ matrix.dotnet-version }}
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ matrix.dotnet-version }}
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ matrix.dotnet-version }}-${{ hashFiles('**/*.*proj') }}
+          restore-keys: |
+            nuget-${{ runner.os }}-${{ matrix.dotnet-version }}-
+            nuget-${{ runner.os }}-
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Cache npm
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: npm-${{ runner.os }}-${{ hashFiles('**/package.json') }}
+          restore-keys: npm-${{ runner.os }}-
+
+      - name: Install npm dependencies
+        run: |
+          if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
+            npm ci
+          else
+            npm install --no-fund --no-audit
+          fi
+
+      - name: Restore
+        run: dotnet restore src/Syncfusion.Blazor.Toolkit.csproj
+
+      - name: Build
+        run: dotnet build src/Syncfusion.Blazor.Toolkit.csproj -c Release --no-restore
+
+      - name: Set timezone and locale for deterministic tests
+        run: |
+          sudo ln -fs /usr/share/zoneinfo/UTC /etc/localtime
+          sudo apt-get update -y
+          sudo apt-get install -y locales
+          sudo locale-gen en_US.UTF-8
+          export LANG=en_US.UTF-8
+          export TZ=UTC
+        shell: bash
+
+      - name: Run bUnit tests
+        run: |
+          mkdir -p TestResults
+          dotnet test tests/Syncfusion.Blazor.Toolkit.BUnitTest/ \
+            -c Release \
+            -f net8.0 \
+            --logger "trx;LogFileName=bunit-${{ matrix.dotnet-version }}.trx" \
+            --logger "html;LogFileName=bunit-${{ matrix.dotnet-version }}.html" \
+            --results-directory TestResults \
+            --collect:"XPlat Code Coverage" \
+            --verbosity normal
+
+      - name: Upload bUnit results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: bunit-results-${{ matrix.dotnet-version }}
+          path: |
+            TestResults/
+            **/coverage.cobertura.xml
+          retention-days: 14
+          if-no-files-found: ignore
+
+      - name: Publish bUnit test results
+        if: always()
+        uses: dorny/test-reporter@v1
+        continue-on-error: true
+        with:
+          name: bUnit (.NET ${{ matrix.dotnet-version }})
+          path: 'TestResults/**/*.trx'
+          reporter: dotnet-trx
+          fail-on-error: false
+          fail-on-empty: false
+
+  # =========================================================
+  # Job 2: Playwright
+  # =========================================================
+  playwright:
+    name: Playwright
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: |
+            8.x
+            9.x
+            10.x
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.*proj') }}
+          restore-keys: nuget-${{ runner.os }}-
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Cache npm
+        uses: actions/cache@v4
+        with:
+          path: ~/.npm
+          key: npm-${{ runner.os }}-${{ hashFiles('**/package.json') }}
+          restore-keys: npm-${{ runner.os }}-
+
+      - name: Install npm dependencies
+        run: |
+          if [ -f package-lock.json ] || [ -f npm-shrinkwrap.json ]; then
+            npm ci
+          else
+            npm install --no-fund --no-audit
+          fi
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        id: playwright-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ hashFiles('**/package.json') }}
+
+      - name: Install Playwright browsers
+        if: steps.playwright-cache.outputs.cache-hit != 'true'
+        run: npx playwright install --with-deps chromium
+
+      - name: Install Playwright system deps
+        if: steps.playwright-cache.outputs.cache-hit == 'true'
+        run: npx playwright install-deps chromium
+
+      - name: Restore
+        run: dotnet restore src/Syncfusion.Blazor.Toolkit.csproj
+
+      - name: Build
+        run: dotnet build src/Syncfusion.Blazor.Toolkit.csproj -c Release --no-restore
+
+      - name: Run Playwright tests
+        run: npx playwright test --reporter=html,line
+        env:
+          CI: true
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: |
+            playwright-report/
+            test-results/
+          retention-days: 14
+          if-no-files-found: ignore
+
+  # =========================================================
+  # Job 3: Summary
+  # =========================================================
+  summary:
+    name: CI Summary
+    runs-on: ubuntu-latest
+    needs: [bunit, playwright]
+    if: always()
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Check results and fail if needed
+        run: |
+          echo "bUnit result: ${{ needs.bunit.result }}"
+          echo "Playwright result: ${{ needs.playwright.result }}"
+
+          if [[ "${{ needs.bunit.result }}" != "success" || "${{ needs.playwright.result }}" != "success" ]]; then
+            echo "One or more jobs failed → failing the workflow"
+            exit 1
+          fi
+
+          echo "All jobs succeeded"
+
+      - name: Post summary comment (PRs only)
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const bunitOk = '${{ needs.bunit.result }}' === 'success';
+            const pwOk = '${{ needs.playwright.result }}' === 'success';
+            const overall = bunitOk && pwOk ? '✅ All checks passed' : '❌ Some checks failed';
+
+            const body = `### CI Summary
+
+            | Job | Status |
+            |-----|--------|
+            | **bUnit** (.NET 8 / 9 / 10) | ${bunitOk ? '✅ Passed' : '❌ Failed'} |
+            | **Playwright** | ${pwOk ? '✅ Passed' : '❌ Failed'} |
+
+            **Overall:** ${overall}
+            `;
+
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body
+            });