Set up CodeQL and Dependabot

.github/PklProject

@@ -21,6 +21,6 @@ dependencies {
     uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.8.0"
   }
   ["com.github.actions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.3.0"
+    uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.6.0"
   }
 }

.github/dependabot.yml

@@ -1,5 +1,15 @@
 version: 2
 updates:
+- package-ecosystem: gomod
+  cooldown:
+    default-days: 7
+    exclude:
+    - github.com/apple/pkl-go
+  directories:
+  - /helm
+  - /prometheus
+  schedule:
+    interval: weekly
 - package-ecosystem: github-actions
   cooldown:
     default-days: 7

.github/index.pkl

@@ -170,3 +170,34 @@ release = (build) {
     }
   }
 }
+
+dependabot {
+  updates {
+    new {
+      `package-ecosystem` = "gomod"
+      cooldown {
+        `default-days` = 7
+        exclude {
+          "github.com/apple/pkl-go"
+        }
+      }
+      schedule {
+        interval = "weekly"
+      }
+      directories {
+        for (reader in readers) {
+          "/" + reader.directory
+        }
+      }
+    }
+  }
+}
+
+codeql {
+  scans {
+    new {
+      language = "go"
+      buildMode = "autobuild"
+    }
+  }
+}