ci: add CodeQL security scanning and Dependabot

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-27 00:05:17 +01:00 · 2026-02-27 00:05:17 +01:00 · 3866c6d6f0
commit 3866c6d6f0
parent ac002131d6
90 changed files with 40 additions and 1 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@ -0,0 +1,14 @@
 version: 2
 updates:
  - package-ecosystem: pip
    directory: /
    schedule:
      interval: weekly
  - package-ecosystem: npm
    directory: /frontend
    schedule:
      interval: weekly
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -0,0 +1,26 @@
 name: CodeQL
 on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "30 5 * * 1"
 jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    strategy:
      matrix:
        language: [python, javascript]
    steps:
      - uses: actions/checkout@v4
      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/autobuild@v3
      - uses: github/codeql-action/analyze@v3
--- a/app/services/domains/arxiv/application.py
+++ b/app/services/domains/arxiv/application.py
--- a/app/services/domains/arxiv/cache.py
+++ b/app/services/domains/arxiv/cache.py
--- a/app/services/domains/arxiv/client.py
+++ b/app/services/domains/arxiv/client.py
--- a/app/services/domains/arxiv/constants.py
+++ b/app/services/domains/arxiv/constants.py
--- a/app/services/domains/arxiv/errors.py
+++ b/app/services/domains/arxiv/errors.py
--- a/app/services/domains/arxiv/gateway.py
+++ b/app/services/domains/arxiv/gateway.py
--- a/app/services/domains/arxiv/guards.py
+++ b/app/services/domains/arxiv/guards.py
--- a/app/services/domains/arxiv/parser.py
+++ b/app/services/domains/arxiv/parser.py
--- a/app/services/domains/arxiv/rate_limit.py
+++ b/app/services/domains/arxiv/rate_limit.py
--- a/app/services/domains/arxiv/types.py
+++ b/app/services/domains/arxiv/types.py
--- a/app/services/domains/crossref/init.py
+++ b/app/services/domains/crossref/init.py
--- a/app/services/domains/crossref/application.py
+++ b/app/services/domains/crossref/application.py
--- a/app/services/domains/dbops/init.py
+++ b/app/services/domains/dbops/init.py
--- a/app/services/domains/dbops/application.py
+++ b/app/services/domains/dbops/application.py
--- a/app/services/domains/dbops/integrity.py
+++ b/app/services/domains/dbops/integrity.py
--- a/app/services/domains/dbops/near_duplicate_repair.py
+++ b/app/services/domains/dbops/near_duplicate_repair.py
--- a/app/services/domains/dbops/query.py
+++ b/app/services/domains/dbops/query.py
--- a/app/services/domains/doi/normalize.py
+++ b/app/services/domains/doi/normalize.py
--- a/app/services/domains/users/init.py
+++ b/app/services/domains/users/init.py
@ -1 +0,0 @@
 from __future__ import annotations
--- a/app/services/ingestion/init.py
+++ b/app/services/ingestion/init.py
--- a/app/services/domains/ingestion/application.py
+++ b/app/services/domains/ingestion/application.py
--- a/app/services/domains/ingestion/constants.py
+++ b/app/services/domains/ingestion/constants.py
--- a/app/services/domains/ingestion/fingerprints.py
+++ b/app/services/domains/ingestion/fingerprints.py
--- a/app/services/domains/ingestion/queue.py
+++ b/app/services/domains/ingestion/queue.py
--- a/app/services/domains/ingestion/safety.py
+++ b/app/services/domains/ingestion/safety.py
--- a/app/services/domains/ingestion/scheduler.py
+++ b/app/services/domains/ingestion/scheduler.py
--- a/app/services/domains/ingestion/types.py
+++ b/app/services/domains/ingestion/types.py
--- a/app/services/domains/openalex/init.py
+++ b/app/services/domains/openalex/init.py
--- a/app/services/domains/openalex/client.py
+++ b/app/services/domains/openalex/client.py
--- a/app/services/domains/openalex/matching.py
+++ b/app/services/domains/openalex/matching.py
--- a/app/services/domains/openalex/types.py
+++ b/app/services/domains/openalex/types.py
--- a/app/services/domains/portability/init.py
+++ b/app/services/domains/portability/init.py
--- a/app/services/domains/portability/application.py
+++ b/app/services/domains/portability/application.py
--- a/app/services/domains/portability/constants.py
+++ b/app/services/domains/portability/constants.py
--- a/app/services/domains/portability/exporting.py
+++ b/app/services/domains/portability/exporting.py
--- a/app/services/domains/portability/normalize.py
+++ b/app/services/domains/portability/normalize.py
--- a/app/services/domains/portability/publication_import.py
+++ b/app/services/domains/portability/publication_import.py
--- a/app/services/domains/portability/scholar_import.py
+++ b/app/services/domains/portability/scholar_import.py
--- a/app/services/domains/portability/types.py
+++ b/app/services/domains/portability/types.py
--- a/app/services/domains/publication_identifiers/init.py
+++ b/app/services/domains/publication_identifiers/init.py
--- a/app/services/domains/publication_identifiers/application.py
+++ b/app/services/domains/publication_identifiers/application.py
--- a/app/services/domains/publication_identifiers/normalize.py
+++ b/app/services/domains/publication_identifiers/normalize.py
--- a/app/services/domains/publication_identifiers/types.py
+++ b/app/services/domains/publication_identifiers/types.py
--- a/app/services/domains/publications/init.py
+++ b/app/services/domains/publications/init.py
--- a/app/services/domains/publications/application.py
+++ b/app/services/domains/publications/application.py
--- a/app/services/domains/publications/counts.py
+++ b/app/services/domains/publications/counts.py
--- a/app/services/domains/publications/dedup.py
+++ b/app/services/domains/publications/dedup.py
--- a/app/services/domains/publications/enrichment.py
+++ b/app/services/domains/publications/enrichment.py
--- a/app/services/domains/publications/listing.py
+++ b/app/services/domains/publications/listing.py
--- a/app/services/domains/publications/modes.py
+++ b/app/services/domains/publications/modes.py
--- a/app/services/domains/publications/pdf_queue.py
+++ b/app/services/domains/publications/pdf_queue.py
--- a/app/services/domains/publications/pdf_resolution_pipeline.py
+++ b/app/services/domains/publications/pdf_resolution_pipeline.py
--- a/app/services/domains/publications/queries.py
+++ b/app/services/domains/publications/queries.py
--- a/app/services/domains/publications/read_state.py
+++ b/app/services/domains/publications/read_state.py
--- a/app/services/domains/publications/types.py
+++ b/app/services/domains/publications/types.py
--- a/app/services/domains/runs/init.py
+++ b/app/services/domains/runs/init.py
--- a/app/services/domains/runs/application.py
+++ b/app/services/domains/runs/application.py
--- a/app/services/domains/runs/events.py
+++ b/app/services/domains/runs/events.py
--- a/app/services/domains/runs/queue_queries.py
+++ b/app/services/domains/runs/queue_queries.py
--- a/app/services/domains/runs/queue_service.py
+++ b/app/services/domains/runs/queue_service.py
--- a/app/services/domains/runs/runs_service.py
+++ b/app/services/domains/runs/runs_service.py
--- a/app/services/domains/runs/summary.py
+++ b/app/services/domains/runs/summary.py
--- a/app/services/domains/runs/types.py
+++ b/app/services/domains/runs/types.py
--- a/app/services/domains/ingestion/init.py
+++ b/app/services/domains/ingestion/init.py
--- a/app/services/domains/scholar/author_rows.py
+++ b/app/services/domains/scholar/author_rows.py
--- a/app/services/domains/scholar/parser.py
+++ b/app/services/domains/scholar/parser.py
--- a/app/services/domains/scholar/parser_constants.py
+++ b/app/services/domains/scholar/parser_constants.py
--- a/app/services/domains/scholar/parser_types.py
+++ b/app/services/domains/scholar/parser_types.py
--- a/app/services/domains/scholar/parser_utils.py
+++ b/app/services/domains/scholar/parser_utils.py
--- a/app/services/domains/scholar/profile_rows.py
+++ b/app/services/domains/scholar/profile_rows.py
--- a/app/services/domains/scholar/rate_limit.py
+++ b/app/services/domains/scholar/rate_limit.py
--- a/app/services/domains/scholar/source.py
+++ b/app/services/domains/scholar/source.py
--- a/app/services/domains/scholar/state_detection.py
+++ b/app/services/domains/scholar/state_detection.py
--- a/app/services/domains/scholar/init.py
+++ b/app/services/domains/scholar/init.py
--- a/app/services/domains/scholars/application.py
+++ b/app/services/domains/scholars/application.py
--- a/app/services/domains/scholars/constants.py
+++ b/app/services/domains/scholars/constants.py
--- a/app/services/domains/scholars/exceptions.py
+++ b/app/services/domains/scholars/exceptions.py
--- a/app/services/domains/scholars/search_hints.py
+++ b/app/services/domains/scholars/search_hints.py
--- a/app/services/domains/scholars/uploads.py
+++ b/app/services/domains/scholars/uploads.py
--- a/app/services/domains/scholars/validators.py
+++ b/app/services/domains/scholars/validators.py
--- a/app/services/domains/scholars/init.py
+++ b/app/services/domains/scholars/init.py
--- a/app/services/domains/settings/application.py
+++ b/app/services/domains/settings/application.py
--- a/app/services/domains/unpaywall/init.py
+++ b/app/services/domains/unpaywall/init.py
--- a/app/services/domains/unpaywall/application.py
+++ b/app/services/domains/unpaywall/application.py
--- a/app/services/domains/unpaywall/pdf_discovery.py
+++ b/app/services/domains/unpaywall/pdf_discovery.py
--- a/app/services/domains/unpaywall/rate_limit.py
+++ b/app/services/domains/unpaywall/rate_limit.py
--- a/app/services/domains/settings/init.py
+++ b/app/services/domains/settings/init.py
--- a/app/services/domains/users/application.py
+++ b/app/services/domains/users/application.py