[MODEL-25234] Dependabot automerge and codeql

.github/workflows/codeql.yml

@@ -0,0 +1,51 @@
+name: CodeQL
+
+on:
+    pull_request:
+    push:
+        branches: [main]
+    # New queries ship with CodeQL releases, so main is also re-scanned weekly.
+    schedule:
+        - cron: "0 6 * * 1"
+    workflow_dispatch:
+
+concurrency:
+    group: codeql-${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+    cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+    contents: read
+
+jobs:
+    analyze:
+        name: CodeQL (${{ matrix.language }})
+        runs-on: ubuntu-latest
+        timeout-minutes: 30
+        permissions:
+            # Reading workflow run metadata is required on non-public repos.
+            actions: read
+            contents: read
+            security-events: write
+        strategy:
+            fail-fast: false
+            matrix:
+                # `actions` scans the workflow files themselves.
+                language: [actions, python]
+        steps:
+            - name: Checkout
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+              with:
+                  persist-credentials: false
+
+            # Neither language needs a build, so CodeQL reads the source directly.
+            - name: Initialize CodeQL
+              uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+              with:
+                  languages: ${{ matrix.language }}
+                  build-mode: none
+                  queries: security-extended
+
+            - name: Analyze
+              uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+              with:
+                  category: /language:${{ matrix.language }}

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,35 @@
+name: Dependabot auto-merge
+
+# Turns on GitHub's native auto-merge for Dependabot PRs. This workflow doesn't
+# merge anything itself: GitHub does, and only once the `main` rulesets are
+# satisfied (required checks green, required review approved). A red or
+# unreviewed PR just sits open like it always did.
+#
+# A merge made on behalf of GITHUB_TOKEN does not fire `push` workflows, so
+# nothing re-runs on main after these merges. The PR runs already covered the
+# merged code, and CodeQL's weekly schedule covers main.
+on: pull_request
+
+permissions: {}
+
+jobs:
+    automerge:
+        name: Enable auto-merge
+        # Keyed on the PR author rather than github.actor, which is whoever
+        # triggered this particular run and changes on a manual re-run.
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
+        runs-on: ubuntu-latest
+        timeout-minutes: 5
+        permissions:
+            # Dependabot-triggered runs get a read-only token unless the
+            # workflow asks for more. Merging needs both of these.
+            contents: write
+            pull-requests: write
+        steps:
+            # No checkout: nothing from the PR branch is executed with the
+            # write token, only the preinstalled gh CLI.
+            - name: Enable auto-merge
+              run: gh pr merge --auto --squash "$PR_URL"
+              env:
+                  PR_URL: ${{ github.event.pull_request.html_url }}
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}