[fabicarvano]

Summary

Strengthens AgentFork's CI and security posture with tools available at no extra license cost for a public GitHub repository. The changes stay isolated to GitHub workflows, Dependabot configuration, and CI documentation.

Changes

• Add CodeQL SAST (javascript-typescript, security-extended) on PRs, main, and weekly.
• Add OSV-Scanner dependency comparisons for PRs plus a weekly full scan.
• Add verified-secret scanning (TruffleHog) and GitHub Actions workflow analysis (Zizmor, initial advisory mode).
• Add a weekly Trivy filesystem/IaC baseline and an image vulnerability scan before ECR publication.
• Add weekly Bun and GitHub Actions Dependabot update proposals.
• Strengthen CI with pinned Bun 1.4.3 (last passing upstream CI runner), checked-out history, database migration and pgvector-index verification, and Nx TypeScript checks.
• Remove the unused Playwright browser installation; existing E2E bootstrap is known to time out and is not represented as passing.
• Gate ECR image publishing behind a successful main push CI run, detect image-relevant changes, and build/scan/push the exact tested commit SHA, retaining OIDC permissions only in the publish job.

Type of Change

• CI/CD or build system change
• Documentation update
• Security hardening
• Breaking change in application code

Testing

• actionlint .github/workflows/*.yml: passed.
• git diff --check: passed.
• Referenced third-party action tags verified on GitHub.
• No application source code modified.
• Nx TypeScript preflight on VPS: started; results are not yet claimed as passing.
• End-to-end tests, real AWS publishing and production scanning were not performed locally.
• New GitHub Actions checks must be reviewed before merge.

Known Limitations and Rollout

• Zizmor and Trivy findings are advisory initially to establish a baseline; turning them into merge/publish blockers requires triage.
• Existing Playwright E2E server setup times out; a separate isolated smoke harness is needed. ESLint and coverage thresholds likewise need working baseline configurations.
• Live channel, multi-tenant, MCP and worker security regression tests, ZAP DAST, and k6 load tests need separate code/test changes and controlled staging.
• A maintainer must enable Dependabot Alerts and choose required status checks in repository settings, since a PR cannot configure those permissions.
• Fork-originating PR CodeQL/SARIF upload behavior must be verified in Actions; do not use pull_request_target to execute untrusted code.
• GitHub Actions standard public-repo runners and CodeQL public-repo analysis are free; AWS ECR, external infrastructure, storage over quotas, and larger runners are not guaranteed free. No new paid service or infrastructure is provisioned.
• Merging this PR changes ECR image build triggering from direct main pushes to completed, successful CI on main. Review this release behavior with the maintainer.

See docs/dev/ci-security.md for the validation matrix and rollout plan.

Checklist

• Security and operational boundaries documented
• Workflows validated by actionlint
• No automatic merge
• New upstream CI and security checks completed and reviewed
• Maintainer reviewed the new publishing trigger

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.