From 226639530f9f62e4c4a97d4500011bf80d8a5543 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Wed, 1 Jul 2026 11:59:59 +0200
Subject: [PATCH 1/3] ci: add security scanning (CodeQL, dependency review,
 secret scan)

---
 .github/workflows/codeql.yml   | 35 +++++++++++++++++++
 .github/workflows/security.yml | 64 ++++++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+)
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..55831cd
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '27 4 * * 1' # Mondays 04:27 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:javascript-typescript'
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..702a18c
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,64 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  # Fails a PR that introduces a dependency with a high+ advisory.
+  # Delta-based: gates NEW risk without tripping on pre-existing debt.
+  dependency-review:
+    name: Dependency Review
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+
+  # Scans the diff for committed secrets. TruffleHog is used instead of
+  # gitleaks-action, which requires a paid licence for organisation accounts.
+  secret-scan:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: TruffleHog
+        uses: trufflesecurity/trufflehog@main
+        with:
+          extra_args: --results=verified,unknown
+
+  # Full-tree audit. Intentionally NON-BLOCKING for now: the tree currently
+  # has a pre-existing dev-only high advisory (vite/esbuild dev server).
+  # Flip `continue-on-error` off once the tree is clean.
+  npm-audit:
+    name: npm audit (advisory)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit
+        run: npm audit --audit-level=high
+        continue-on-error: true

From a25b53e55517e6119ae0aaf47665c5589c18a9d3 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Wed, 1 Jul 2026 12:01:52 +0200
Subject: [PATCH 2/3] ci: make dependency review non-blocking until dependency
 graph is enabled

---
 .github/workflows/security.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 702a18c..4f7b1cc 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,8 +9,13 @@ permissions:
   contents: read
 
 jobs:
-  # Fails a PR that introduces a dependency with a high+ advisory.
+  # Flags a PR that introduces a dependency with a high+ advisory.
   # Delta-based: gates NEW risk without tripping on pre-existing debt.
+  #
+  # NON-BLOCKING for now: this repo has the GitHub Dependency graph disabled,
+  # so the action cannot run yet. An admin must enable it under
+  # Settings → Code security → Dependency graph. Once enabled, remove
+  # `continue-on-error` below to turn this into a real gate.
   dependency-review:
     name: Dependency Review
     if: github.event_name == 'pull_request'
@@ -21,6 +26,7 @@ jobs:
 
       - name: Dependency review
         uses: actions/dependency-review-action@v4
+        continue-on-error: true
         with:
           fail-on-severity: high
 

From 6142a88464584d0c04b8c6387667df6a6ea139de Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Wed, 1 Jul 2026 13:07:04 +0200
Subject: [PATCH 3/3] ci: enable dependency review gate now that the dependency
 graph is on

---
 .github/workflows/security.yml | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 4f7b1cc..702a18c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -9,13 +9,8 @@ permissions:
   contents: read
 
 jobs:
-  # Flags a PR that introduces a dependency with a high+ advisory.
+  # Fails a PR that introduces a dependency with a high+ advisory.
   # Delta-based: gates NEW risk without tripping on pre-existing debt.
-  #
-  # NON-BLOCKING for now: this repo has the GitHub Dependency graph disabled,
-  # so the action cannot run yet. An admin must enable it under
-  # Settings → Code security → Dependency graph. Once enabled, remove
-  # `continue-on-error` below to turn this into a real gate.
   dependency-review:
     name: Dependency Review
     if: github.event_name == 'pull_request'
@@ -26,7 +21,6 @@ jobs:
 
       - name: Dependency review
         uses: actions/dependency-review-action@v4
-        continue-on-error: true
         with:
           fail-on-severity: high