From ee00cc361b490e56cdc8e8e60ea4302cc43c07fe Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Fri, 23 Oct 2026 00:27:54 +0530
Subject: [PATCH 1/2] security: add repository security controls for v1 (#280)

---
 .github/dependabot.yml        | 17 +++++++++++++++
 .github/workflows/codeql.yml  | 41 +++++++++++++++++++++++++++++++++++
 CHANGELOG.md                  |  2 ++
 docs/security-threat-model.md | 15 +++++++++++++
 4 files changed, 75 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/codeql.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7e91765
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      development-dependencies:
+        dependency-type: development
+      production-dependencies:
+        dependency-type: production
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..3cfd945
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Analyze source
+        uses: github/codeql-action/analyze@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
+        with:
+          category: /language:python
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d3482a1..4f80a5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@ and versions are tracked in the repo-root `VERSION` file.
 ### Changed
 
 - Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
+- Add CodeQL analysis, Dependabot update policy, and repository security-control
+  documentation for the 1.0 release gate (#280).
 
 ## [0.5.1] - 2026-10-10
 
diff --git a/docs/security-threat-model.md b/docs/security-threat-model.md
index b7c46e6..d7883a0 100644
--- a/docs/security-threat-model.md
+++ b/docs/security-threat-model.md
@@ -99,6 +99,21 @@ The generic framework defaults to:
 These defaults reduce accidental exposure; they are not a sandbox or encryption
 boundary.
 
+## Repository controls
+
+The repository supplements the runtime threat model with GitHub controls:
+
+- Dependabot security updates and weekly dependency update proposals;
+- secret scanning and push protection, subject to the organization plan's
+  supported provider and non-provider patterns; and
+- CodeQL analysis for the Python source on pushes, pull requests, and a weekly
+  scheduled run.
+
+These controls are defense in depth. They do not replace the local Bandit,
+`pip-audit`, redaction, extension trust-boundary, or release-attestation gates.
+Maintainers should read back the repository settings after changes and record
+any plan-limited control together with its compensating control.
+
 ## Non-goals
 
 `base-cli` does not provide:

From 2395c91fc4280b7396ba388185ca3cb56f1ddbfd Mon Sep 17 00:00:00 2001
From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:48:42 +0530
Subject: [PATCH 2/2] fix: align security automation with uv

---
 .github/dependabot.yml        | 2 +-
 CHANGELOG.md                  | 2 ++
 docs/security-threat-model.md | 2 +-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7e91765..bf74744 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: pip
+  - package-ecosystem: uv
     directory: "/"
     schedule:
       interval: weekly
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f80a5f..013c7b9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ and versions are tracked in the repo-root `VERSION` file.
 - Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
 - Add CodeQL analysis, Dependabot update policy, and repository security-control
   documentation for the 1.0 release gate (#280).
+- Configure Dependabot for the repository's checked-in uv lockfile instead of
+  the pip ecosystem so automated updates preserve the lockfile validation gate.
 
 ## [0.5.1] - 2026-10-10
 
diff --git a/docs/security-threat-model.md b/docs/security-threat-model.md
index d7883a0..ccbc793 100644
--- a/docs/security-threat-model.md
+++ b/docs/security-threat-model.md
@@ -99,7 +99,7 @@ The generic framework defaults to:
 These defaults reduce accidental exposure; they are not a sandbox or encryption
 boundary.
 
-## Repository controls
+## GitHub repository security controls
 
 The repository supplements the runtime threat model with GitHub controls: