Add CodeQL and dependency review security scanning

[konard]

Summary

• add scheduled and change-triggered CodeQL analysis for Python and GitHub Actions workflows
• review pull-request dependency changes and reject newly introduced high/critical vulnerabilities
• enforce least-privilege permissions, explicit timeouts, and cancellable CodeQL concurrency
• add a regression test and security changelog fragment

Reproduction

On main, .github/workflows/security.yml does not exist, so pull requests receive neither CodeQL analysis nor dependency review. The new test_security_workflow_scans_code_actions_and_dependencies test reproduces this as a missing-workflow failure before the implementation.

Verification

• pytest --cov=src --cov-report=term — 65 passed, 100% package coverage
• ruff check .
• ruff format --check .
• mypy src
• python scripts/check_file_size.py
• npx --yes -p secretlint -p @secretlint/secretlint-rule-preset-recommend secretlint '**/*'
• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/security.yml

Whole-repository actionlint also finds two pre-existing queue: max syntax errors in release.yml at lines 467 and 574; the new workflow itself passes actionlint.

Fixes #48

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[konard]

Working session summary

Implemented and finalized PR #51.

• Added CodeQL scanning for Python and GitHub Actions.
• Added dependency review blocking high/critical vulnerabilities.
• Added regression tests and changelog entry.
• Enabled the repository dependency graph prerequisite.
• Local suite: 65 tests passed, 100% coverage.
• CI/CD and Security workflows pass for SHA a0ddc56.
• PR title/body updated and marked ready for review.
• Working tree is clean.

---

This summary was automatically extracted from the AI working session output.

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Model: GPT-5.6 Sol
• Provider: OpenAI
• Public pricing estimate: $3.605549

📊 Context and tokens usage:

• 133.6K / 200K (67%) input tokens, 9.8K / 128K (8%) output tokens

Total: (133.6K + 1.8M cached) input tokens, 9.8K output tokens, $3.605549 cost

🤖 Models used:

• Tool: OpenAI Codex
• Requested: gpt-5.6-sol
• Thinking level: low (~7999 tokens)
• Model: GPT 5.6 Sol (gpt-5.6-sol)

📎 Log file uploaded as Gist (1365KB)

• View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

🎉 Auto-merged

This pull request has been automatically merged by hive-mind.

• All CI checks have passed

---

Auto-merged by hive-mind with --auto-merge flag