chore(ci): OSS hygiene (dependabot.yml, CODEOWNERS, scorecard workflow)

[KooshaPari]

User description

Bundle of 2 commits from chore/dependabot-2026-06-08:

• 1c80ead chore(ci): add dependabot.yml for OmniRoute
• c90a8b5 chore(ci): add CODEOWNERS + OpenSSF Scorecard workflow for OmniRoute

All small, validated, non-breaking.

---

Note

Low Risk
Meta-only GitHub configuration; no runtime or auth logic changes, though Dependabot will open dependency PRs and Scorecard needs security-events write on the workflow job.

Overview
Adds repository governance and supply-chain hygiene without touching application code.

CODEOWNERS assigns @KooshaPari as the default reviewer repo-wide, with explicit ownership for .github, SECURITY.md, major monorepo paths (/rust, /electron, /open-sse, etc.), and workflow files.

Dependabot enables weekly update PRs for root and nested npm workspaces (open-sse, electron, desktop-electrobun), plus Docker and GitHub Actions at the repo root. Root npm updates use grouped PRs (React, testing, build tooling), chore(deps) commits, labels, and PR limits.

OpenSSF Scorecard runs on a weekly schedule, manual dispatch, and branch protection changes; it publishes SARIF to code scanning and stores a short-lived artifact, using pinned action SHAs and minimal default permissions with elevated job permissions only where needed.

^{Reviewed by Cursor Bugbot for commit c90a8b5. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Add repository ownership, automated dependency updates, and security scoring

What Changed

• Weekly Dependabot updates now cover the main app, the three workspace packages, Docker, and GitHub Actions
• Dependency update PRs are grouped for common React, testing, and build tool packages, with labels and review assignment added
• CODEOWNERS now assigns a default reviewer for the repo and specific ownership for governance files, workspaces, docs, and CI
• OpenSSF Scorecard now runs on a weekly schedule and manual trigger, then uploads results for code scanning and keeps a short-lived artifact

Impact

✅ Fewer missed dependency updates
✅ Faster review routing for repo changes
✅ Earlier detection of supply-chain issues

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Review limit reached

@KooshaPari, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 2 minutes and 53 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d635a6c5-5ddc-421f-b319-be61b9b54a9b

📥 Commits

Reviewing files that changed from the base of the PR and between 532f530 and c90a8b5.

📒 Files selected for processing (3)

• .github/CODEOWNERS
• .github/dependabot.yml
• .github/workflows/scorecard.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-2026-06-08

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/dependabot-2026-06-08

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.3.14
	electrobun@​1.18.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm electrobun Location: Package overview From: desktop-electrobun/package.json → npm/electrobun@1.18.1 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/electrobun@1.18.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Deprecated by its maintainer: npm rcedit Reason: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. From: ? → npm/electrobun@1.18.1 → npm/rcedit@4.0.1 ℹ Read more on: This package | This alert | What is a deprecated package? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Research the state of the package and determine if there are non-deprecated versions that can be used, or if it should be replaced with a new, supported solution. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rcedit@4.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[codeant-ai]

CodeAnt AI finished reviewing your PR.