ci: add dependency and repository security gates

.github/workflows/ci.yml

@@ -10,6 +10,29 @@ permissions:
   contents: read
 
 jobs:
+  dependency-audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: 24
+          cache: npm
+          cache-dependency-path: package-lock.json
+      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+        with:
+          toolchain: 1.97.1
+      - run: npm ci
+      - run: npm audit --audit-level=high
+      - name: Install pinned cargo-audit
+        run: cargo install cargo-audit --version 0.22.2 --locked
+      - name: Audit Rust lockfiles
+        run: |
+          cargo audit --file src-tauri/Cargo.lock
+          cargo audit --file src-tauri/startup-launcher/Cargo.lock
+          cargo audit --file tools/updater-signature-verifier/Cargo.lock
+
   frontend:
     runs-on: ubuntu-latest
     steps:

.github/workflows/codeql.yml

@@ -0,0 +1,30 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          languages: javascript-typescript
+      - name: Analyze
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        with:
+          category: /language:javascript-typescript

.github/workflows/release-tauri.yml

@@ -96,6 +96,14 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Audit dependencies at release tag
+        run: |
+          npm audit --audit-level=high
+          cargo install cargo-audit --version 0.22.2 --locked
+          cargo audit --file src-tauri/Cargo.lock
+          cargo audit --file src-tauri/startup-launcher/Cargo.lock
+          cargo audit --file tools/updater-signature-verifier/Cargo.lock
+
       - name: Validate frontend at release tag
         run: |
           npm run lint