ci(security): real scans, tokenless — dependabot, pip-audit over the lock, CodeQL (#291)

[eaitbrahim]

What & why

Part of #291 (the pre-launch gate's code-quality-scans item, which the gate blocks on): the repo has never had static analysis or dependency scanning — SONAR_TOKEN/SNYK_TOKEN were names for secrets nobody created. This PR configures both classes of scan using what a public repository gets for free, on GITHUB_TOKEN alone:

• .github/dependabot.yml — weekly, grouped updates for all six Python manifests (root + five packages/*) and the github-actions ecosystem. A manifest Dependabot doesn't see is a distribution whose dependencies update silently.
• .github/workflows/security.yml — a dependencies job that audits uv export of the locked set (pip-audit; the exact pinned versions deployments get), and a codeql job (Python) with security-events: write). Runs on push, PRs, and weekly — CVEs are published against already-pinned versions, not only against new commits. Deliberately NOT the testjob: themainruleset requires thetest` context, and a security finding is information about the state of the world, not a verdict on a proposed change — so these jobs surface findings without gating merges.
• uv.lock — the audit's first run (locally, verified end-to-end) surfaced PYSEC-2026-3552 in cryptography 49.0.0, fixed in 50.0.0; upgraded in the same commit so the scan ships green rather than red on day one. Full suite green on the upgrade.

tests/test_security_scans.py (red-first, 6 tests) pins: every manifest directory watched + schedules present, the audit reads the lock's export with the six own-distributions excluded, CodeQL init+analyze on Python with the upload permission, the weekly schedule trigger, and — the honest part — that no scan step references any secret at all (SONAR_TOKEN/SNYK_TOKEN never existed; a scan that needs them is a scan that doesn't run).

Tests-first evidence

Red run: 6/6 failed (no configs existed). Green: 6 passed, full suite 2847 passed / 1 skipped. The pip-audit step was verified end-to-end locally: found the cryptography advisory on the pre-upgrade lock, clean on the upgraded one.

Gates

• uv run ruff check keel tests packages — All checks passed!
• uv run mypy — Success: no issues found in 236 source files
• uv run pytest -q — 2847 passed, 1 skipped

Scope check

• No rail, rule, or default classification is touched — CI configuration, a dependency upgrade the new scan surfaced, and pinning tests.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[eaitbrahim]

Review round applied:

• Blocker (the real one): the "no secrets" test no longer curates a two-file list. It now asserts the actual invariant: the always-on workflows reference no secrets beyond GITHUB_TOKEN, and code-quality.yml — which this PR's original test silently ignored — may reference SONAR_TOKEN/SNYK_TOKEN only from jobs guarded by needs: preflight + the configured gate, pinned structurally per job. code-quality.yml's header now states the split: tokenless baseline in security.yml, optional tier there.
• Major: uv export --frozen (audit the lock as committed, never a fresh resolve — code-quality.yml's own documented stance); manifest lists derived from the filesystem (a seventh packages/* distribution now fails CI until Dependabot and the export learn about it), including a stale-entry check.
• Minor: dev-group inclusion in the export documented in the workflow (deliberate: the job gates nothing, wider advisory net); pyyaml added as an explicit dev dependency (the test imports it directly, per the pyproject's own rule); workflow_dispatch + a non-cancelling concurrency group, matching code-quality.yml's conventions.

Note for post-merge: the five packages/* Dependabot entries share the root uv.lock — if Dependabot's log shows them inert or erroring, collapse to the root entry (tracked in the gate doc).