ci: standardize dependabot automerge #178

	name: Security Scans

	"on":
	schedule:
	- cron: '0 2 * * 1'
	push:
	branches: [main]
	pull_request:
	branches: [main]
	workflow_dispatch:

	jobs:
	codeql:
	name: CodeQL Analysis
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

	- name: Initialize CodeQL
	uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	with:
	languages: python
	build-mode: none

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	with:
	category: "/language:python"

	bandit:
	name: Bandit Security Scan
	runs-on: ubuntu-latest
	timeout-minutes: 10
	permissions:
	contents: read
	security-events: write
	steps:
	- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

	- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
	with:
	python-version: "3.12"

	- name: Install Bandit
	run: pip install "bandit[toml,sarif]"

	- name: Run Bandit
	run: \|
	bandit -r src/ -f sarif -o bandit-results.sarif \|\| true
	bandit -r src/ -f txt \|\| true

	- name: Upload SARIF to GitHub Security
	uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
	if: always()
	with:
	sarif_file: bandit-results.sarif
	wait-for-processing: true

Provide feedback