ci: harden OSS CI with CodeQL, Scorecard, Dependabot, and SECURITY.md (closes #282, closes #277)

[Madhumasa84]

Problem

The repository currently lacks automated static code analysis (CodeQL), supply-chain posture analysis (OpenSSF Scorecard),
automated weekly dependency version updates (Dependabot), continuous dependency vulnerability auditing (pip-audit), and a
formal vulnerability disclosure policy (SECURITY.md). Without these, dependency updates and vulnerability scans must be
maintained manually, and security researchers lack a dedicated private disclosure path.

Closes #282
Closes #277

Prior art - what already exists

• I extended an existing pattern. Which one, and what I followed:
  Followed standard GitHub Actions and OpenSSF workflow conventions alongside existing CI workflows (oss-guard.yml,
  security-regression.yml).

Tangential updates: None.

Solution - high level

• Added .github/dependabot.yml to automate weekly updates across GitHub Actions, Python root dependencies, and adapter npm
  packages.
• Added .github/workflows/codeql.yml for CodeQL SAST scanning across Python and JavaScript/TypeScript.
• Added .github/workflows/scorecard.yml for OpenSSF Scorecard supply-chain evaluation.
• Added .github/workflows/dependency-scan.yml for automated pip-audit CVE checks on pushes and PRs.
• Added SECURITY.md defining supported versions, private reporting channels (GitHub Advisories & security@prismor.dev),
  and response SLAs.

Deep dive - how it works

• CodeQL (codeql.yml): Analyzes Python and JavaScript/TypeScript codebases with github/codeql-action/init@v3 and
  analyze@v3. Configured with least-privilege permissions (security-events: write, contents: read).
• OpenSSF Scorecard (scorecard.yml): Scans weekly with ossf/scorecard-action@v2.4.0 and exports SARIF results to
  GitHub Security with publish_results: true.
• Dependabot (dependabot.yml): Configured with version 2 syntax covering 4 package ecosystems: github-actions in /,
  pip in /, and npm in /adapters/mastra and /adapters/vercel-ai.
• Dependency Audit (dependency-scan.yml): Installs pip-audit and project dependencies (pip install .) to check
  against known CVE databases (OSV/PyPI).
• Security Policy (SECURITY.md): Contains responsible disclosure instructions, 48h acknowledgment SLA, and scope
  definitions without any emojis or external dependencies.

Files changed

File	Why it changed
.github/dependabot.yml	Configures automated weekly dependency bumps for Actions, pip, and npm adapters
.github/workflows/codeql.yml	Adds automated CodeQL SAST scanning on pushes, PRs, and weekly schedule
.github/workflows/scorecard.yml	Adds OpenSSF Scorecard automated supply-chain analysis
.github/workflows/dependency-scan.yml	Adds CI step to audit Python dependencies for known CVEs via pip-audit
SECURITY.md	Provides formal security policy and private vulnerability reporting instructions

Testing

python3 scripts/check_oss_safe.py
bash scripts/verify_registry.sh
pytest tests/test_oss_guard.py tests/test_policies.py tests/test_policy_engine.py tests/test_hooks.py
python3 -c "import yaml; [yaml.safe_load(open(f)) for f in ['.github/dependabot.yml','.github/workflows/codeql.yml','.github/workflows/scorecard.yml','.github/workflows/dependency-scan.yml']]"

[✓] bash scripts/run_security_tests.sh passes
[✓] Added or updated tests covering the new behavior
[✓] If an integration changed: bash scripts/verify_registry.sh
[✓] All 369 core tests passed; YAML syntax validated on all 4 configuration files
[✓] OSS safety guard passed (449 files scanned, 0 leaks)

Security checklist

[✓] No detection patterns hardcoded in Python — all rules live in YAML
[✓] No real secrets, keys, or credentials in code, tests, fixtures, or docs
[✓] No real secret values printed, logged, or serialized (used @@secret:@@)
[✓] No guardrail weakened; if one was, it is called out and justified above
[✓] Docs that describe this behavior (SKILL.md, docs/, AGENTS.md) are still accurate

Diff size

Lines changed: +227 / -0 · Justification if large: 5 new configuration and documentation files only; zero existing runtime code
modified.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.