Summary

Adds two baseline security checks:

• Dependency Review on PRs
• CodeQL scanning (javascript-typescript) on PRs, main, and a weekly schedule

Why

Secret scanning (detect-secrets) is great but doesn’t catch vulnerable dependency changes or common insecure code patterns. These are standard, low-risk guardrails for a project of this surface area.

Notes

• Minimal permissions (contents:read, security-events:write for CodeQL)

Greptile Overview

Greptile Summary

This PR adds two GitHub Actions workflows under .github/workflows/ to introduce baseline security guardrails: a CodeQL analysis workflow for JavaScript/TypeScript that runs on pushes to main, pull requests, and a weekly schedule, and a Dependency Review workflow that runs on pull requests to detect vulnerable dependency changes. Both workflows use minimal permissions (contents: read, and security-events: write for CodeQL) and rely on standard, maintained GitHub Actions.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk; it only adds standard GitHub security workflows.
• Changes are limited to adding two well-known GitHub Actions workflows (CodeQL and dependency review) with minimal permissions and no application code impact; configuration is straightforward and matches common defaults.
• No files require special attention

_{(5/5) You can turn off certain types of comments like style here!}

Context used:

• Context from dashboard - CLAUDE.md (source)
• Context from dashboard - AGENTS.md (source)