chore(ci): add dependency audit and Dependabot

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: 'uv'
+    # uv workspace root: one uv.lock covers every packages/* member.
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 7
+  - package-ecosystem: 'github-actions'
+    # '/' covers .github/workflows only; the composite actions pin their own actions.
+    directories:
+      - '/'
+      - '/.github/actions/*'
+    schedule:
+      interval: 'weekly'
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [main]
   pull_request:
+  # Weekly, so an advisory published against an unchanged uv.lock still gets reported.
+  schedule:
+    - cron: "0 13 * * 1"
 
 permissions:
   contents: read
@@ -23,6 +26,20 @@ jobs:
       - run: uv run ruff check .
       - run: uv run ruff format --check .
 
+  # ─── Dependency audit ───────────────────────────────────────────────────────
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    # A new advisory must not block unrelated PRs; push and the weekly schedule still fail on it.
+    continue-on-error: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      # Audits the committed uv.lock as-is (no `uv lock` first), so a vulnerable pin fails here.
+      - run: make audit
+
   # ─── Setup ──────────────────────────────────────────────────────────────────
   setup:
     name: Install & sync

Makefile

@@ -1,4 +1,4 @@
-.PHONY: start test typecheck lint format format-check lint-fix build check-packaging clean api-report api-report-check
+.PHONY: start test typecheck lint format format-check lint-fix build check-packaging clean api-report api-report-check audit
 
 # Run main.py (uv run python main.py)
 start:
@@ -60,3 +60,10 @@ check-packaging:
 # Clean build artifacts
 clean:
 	rm -rf packages/*/dist
+
+# Report known vulnerabilities in the locked dependency set (pip-audit on uv.lock)
+# Exports to a file, not a pipe: make's /bin/sh has no pipefail, so a failed export would audit nothing and pass
+audit:
+	reqs=$$(mktemp) && trap 'rm -f "$$reqs"' EXIT && \
+	uv export --all-packages --no-emit-workspace --frozen -q -o "$$reqs" && \
+	uvx pip-audit@2.9.0 --disable-pip --no-deps -r "$$reqs"