security: add repository security controls for v1 (#280)

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: uv
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      development-dependencies:
+        dependency-type: development
+      production-dependencies:
+        dependency-type: production
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
+        with:
+          languages: python
+          build-mode: none
+
+      - name: Analyze source
+        uses: github/codeql-action/analyze@4bfa242aa49c5f7c6770b98670d354a7dfac05f8 # v3
+        with:
+          category: /language:python

CHANGELOG.md

@@ -14,6 +14,10 @@ and versions are tracked in the repo-root `VERSION` file.
 ### Changed
 
 - Include `uv.lock` freshness in the authoritative local validation aggregate (#424).
+- Add CodeQL analysis, Dependabot update policy, and repository security-control
+  documentation for the 1.0 release gate (#280).
+- Configure Dependabot for the repository's checked-in uv lockfile instead of
+  the pip ecosystem so automated updates preserve the lockfile validation gate.
 - Clarify that extension capabilities are informational metadata, and require
   fully qualified or distribution-prefixed extension allowlist entries (#397).
 - Match distribution-prefixed extension allowlists against the exact installed

docs/security-threat-model.md

@@ -99,6 +99,21 @@ The generic framework defaults to:
 These defaults reduce accidental exposure; they are not a sandbox or encryption
 boundary.
 
+## GitHub repository security controls
+
+The repository supplements the runtime threat model with GitHub controls:
+
+- Dependabot security updates and weekly dependency update proposals;
+- secret scanning and push protection, subject to the organization plan's
+  supported provider and non-provider patterns; and
+- CodeQL analysis for the Python source on pushes, pull requests, and a weekly
+  scheduled run.
+
+These controls are defense in depth. They do not replace the local Bandit,
+`pip-audit`, redaction, extension trust-boundary, or release-attestation gates.
+Maintainers should read back the repository settings after changes and record
+any plan-limited control together with its compensating control.
+
 ## Non-goals
 
 `base-cli` does not provide: