ci: establish enterprise GitHub Actions automation baseline

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: {interval: weekly}
+    open-pull-requests-limit: 10

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.lang.outputs.languages }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: lang
+        shell: bash
+        run: |
+          set -euo pipefail
+          langs=''
+          [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python"
+          [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript"
+          [ -f go.mod ] && langs="$langs go"
+          [ -f Cargo.toml ] && langs="$langs rust"
+          [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin"
+          [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp"
+          [ -n "$langs" ] || langs=' python'
+          json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')"
+          echo "languages=$json" >> "$GITHUB_OUTPUT"
+  analyze:
+    needs: detect
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.detect.outputs.languages) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,9 @@
+name: Dependency Review
+on: {pull_request:}
+permissions: {contents: read, pull-requests: read}
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/dependency-review-action@v4
+        with: {fail-on-severity: high}

.github/workflows/security.yml

@@ -0,0 +1,18 @@
+name: Security
+on:
+  push:
+  pull_request:
+  schedule: [{cron: '41 4 * * 1'}]
+permissions: {contents: read, security-events: write}
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: {fetch-depth: 0}
+      - uses: gitleaks/gitleaks-action@v2
+      - uses: aquasecurity/trivy-action@master
+        with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: 'HIGH,CRITICAL', exit-code: '1'}
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: {sarif_file: trivy-results.sarif}