fix: address OpenSSF Scorecard findings

[don-petry]

Summary

• Add SECURITY.md for security policy (Scorecard: Security-Policy (0/10) #8)
• Scope workflow token permissions to least privilege (Scorecard: Token-Permissions (9/10) #9)
• Add Dependabot for dependency updates (Scorecard: Dependency-Update-Tool (0/10) #10)
• Ensure SAST (CodeQL) runs on all commits (Scorecard: SAST (6/10) #11)

Closes #8, #9, #10, #11

Test plan

• Verify CI passes on this PR
• Verify CodeQL workflow runs
• Verify Dependabot detects ecosystems

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores

  • Enabled automated weekly dependency updates for GitHub Actions.
  • Updated CI workflows: adjusted workflow-level permissions and updated an action input key.

• Chores / Security

  • Added automated CodeQL security scanning to detect vulnerabilities.

• Documentation

  • Published a security policy with reporting instructions, timelines, and patch release guidance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0c496b87-9104-472e-9a16-be9f04be901a

📥 Commits

Reviewing files that changed from the base of the PR and between f31faf3 and af56f54.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/claude.yml

---

📝 Walkthrough

Walkthrough

Added Dependabot config for weekly GitHub Actions updates, introduced a CodeQL GitHub Actions workflow, adjusted workflow-level permissions and an action input in an existing Claude workflow, and added a SECURITY.md describing vulnerability reporting and timelines.

Changes

Cohort / File(s)	Summary
Dependabot config .github/dependabot.yml	New Dependabot config (version 2) scheduled weekly for the github-actions ecosystem at repo root.
CodeQL workflow .github/workflows/codeql.yml	New CodeQL workflow: triggers on push/PR/main and schedule, grants security-events: write, checks out repo, runs github/codeql-action/init then github/codeql-action/analyze.
Claude workflow update .github/workflows/claude.yml	Added top-level permissions: {} and renamed action input key in a step from anthropic_api_key → claude_code_oauth_token (still uses secrets.CLAUDE_CODE_OAUTH_TOKEN).
Security policy SECURITY.md	Added project security policy with private reporting email, required report contents, acknowledgement/fix timelines, and release notes guidance.

Sequence Diagram(s)

mermaid
sequenceDiagram
participant Trigger as "Trigger (push/PR/cron)"
participant Actions as "GitHub Actions Runner"
participant Repo as "Repository (checkout)"
participant CodeQLInit as "codeql-action/init"
participant CodeQLAnalyze as "codeql-action/analyze"
Trigger->>Actions: schedule / push / pull_request
Actions->>Repo: checkout code
Actions->>CodeQLInit: init CodeQL (matrix: actions)
CodeQLInit-->>Actions: toolchains configured
Actions->>CodeQLAnalyze: run analysis
CodeQLAnalyze-->>Actions: results uploaded (security-events: write)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Add Claude Code GitHub Action #5 — Modifies the same .github/workflows/claude.yml workflow, including workflow-level permissions and renaming the action input key.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	Changes to .github/workflows/claude.yml and additions of .github/dependabot.yml and .github/workflows/codeql.yml appear to be out of scope for the single linked issue #8, which only requires a SECURITY.md file.	Clarify the scope: either ensure all changes align with a single issue, or link additional issues (#9, #10, #11) mentioned in the PR description to justify the expanded changes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main objective of the PR: addressing OpenSSF Scorecard findings by adding security configurations and policies.
Linked Issues check	✅ Passed	The PR successfully implements the requirement from issue #8 by adding a SECURITY.md file that documents the security policy, addressing the OpenSSF Scorecard finding.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch scorecard-fixes

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Addresses OpenSSF Scorecard findings by adding missing security policy/documentation and hardening/expanding GitHub security automation (dependency updates and SAST scanning).

Changes:

• Add SECURITY.md security policy document.
• Add Dependabot configuration for GitHub Actions updates.
• Add a CodeQL workflow and adjust workflow token permissions.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
SECURITY.md	Introduces a security policy and vulnerability reporting guidance.
.github/workflows/codeql.yml	Adds CodeQL SAST workflow configuration.
.github/workflows/claude.yml	Changes workflow-level token permissions.
.github/dependabot.yml	Enables Dependabot updates for GitHub Actions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/codeql.yml:
- Around line 9-12: The workflow currently limits CodeQL scans to pushes on
branch `main` (the `push:` key contains `branches: [main]`), so commits pushed
to other branches are skipped; update the `push:` trigger to run on all branches
by replacing the `branches: [main]` restriction (either remove the `branches`
filter or change it to a wildcard such as `branches: ['**']`) while leaving the
existing `pull_request:` trigger intact so PR scans still run.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 01a1f2f4-cab3-4f61-bb40-b942d6264c7f

📥 Commits

Reviewing files that changed from the base of the PR and between f1c68fb and f31faf3.

📒 Files selected for processing (4)

• .github/dependabot.yml
• .github/workflows/claude.yml
• .github/workflows/codeql.yml
• SECURITY.md

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud