chore(security): standardize SDLC security baseline

.github/dependabot.yml

@@ -1,11 +1,21 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
+# Dependabot: version updates + security updates.
+# - pip ecosystem covers Poetry (pyproject.toml / poetry.lock).
+# - github-actions keeps workflow action versions current (supply-chain hardening).
+# Updates are grouped to minimize PR noise.
 version: 2
 updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/" # Location of package manifests
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      python-dependencies:
+        patterns: ["*"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]

.github/workflows/bandit.yml

@@ -0,0 +1,37 @@
+# Bandit: Python-specific static security analysis (hardcoded secrets, shell
+# injection, unsafe deserialization, etc.). Complements CodeQL; results are
+# reported to the Security tab via SARIF. Non-blocking (--exit-zero); CodeQL is
+# the gate. Replaces the Python coverage previously provided by OSSAR.
+name: Bandit
+
+on:
+  push:
+    branches: ["development"]
+  pull_request:
+    branches: ["development"]
+  schedule:
+    - cron: "30 7 * * 2"
+
+permissions:
+  contents: read
+
+jobs:
+  bandit:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install Bandit
+        run: pip install "bandit[sarif]"
+      - name: Run Bandit
+        run: bandit -r . -x ./tests,./.venv,./venv -f sarif -o bandit.sarif --exit-zero
+      - name: Upload SARIF to code-scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: bandit.sarif

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+# Scans dependency manifest changes on PRs and blocks pull requests that
+# introduce known-vulnerable dependencies. Native GitHub action, no external service.
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: ["development"]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: on-failure

.github/workflows/scorecard.yml

@@ -0,0 +1,47 @@
+# OpenSSF Scorecard: measures supply-chain security posture (branch protection,
+# pinned dependencies, token permissions, etc.) and reports to the Security tab.
+name: Scorecard supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "20 7 * * 2"
+  push:
+    branches: ["development"]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge.
+      id-token: write
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif