ci: establish enterprise GitHub Actions automation baseline

.github/workflows/codeql.yml

@@ -0,0 +1,44 @@
+name: CodeQL
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.lang.outputs.languages }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: lang
+        shell: bash
+        run: |
+          set -euo pipefail
+          langs=''
+          [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python"
+          [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript"
+          [ -f go.mod ] && langs="$langs go"
+          [ -f Cargo.toml ] && langs="$langs rust"
+          [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin"
+          [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp"
+          [ -n "$langs" ] || langs=' python'
+          json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')"
+          echo "languages=$json" >> "$GITHUB_OUTPUT"
+  analyze:
+    needs: detect
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.detect.outputs.languages) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,9 @@
+name: Dependency Review
+on: {pull_request:}
+permissions: {contents: read, pull-requests: read}
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/dependency-review-action@v4
+        with: {fail-on-severity: high}

.github/workflows/security.yml

@@ -49,7 +49,7 @@ jobs:
           scan-ref: .
           format: sarif
           output: trivy-results.sarif
-          severity: HIGH,CRITICAL
+          severity: 'HIGH,CRITICAL'
           ignore-unfixed: true
           exit-code: "0"
       - uses: github/codeql-action/upload-sarif@v4