Add security scanning CI (CodeQL, pip-audit, Dependabot) and pre-commit

[ivan-pinatti]

Summary

Implements the security scanning proposal from #91.

Adds free, automated security scanning at two levels:

CI (GitHub Actions)

• CodeQL — SAST for Python; finds logic bugs, injection flaws, unsafe API usage. Results appear in Security > Code scanning.
• pip-audit — fully installs the project (including PyGObject) in a clean Ubuntu runner with system libs, then scans all dependencies including transitive ones against the OSV database for known CVEs.
• Dependabot — opens PRs automatically when pip dependencies or GitHub Actions versions have updates.

Local (pre-commit)

• bandit — SAST on staged Python files before each commit; immediate local feedback without waiting for CI.
• pip-audit — scans direct dependencies from requirements.txt against the OSV database before each commit.
  • PyGObject is excluded from requirements.txt: it requires gobject-introspection system headers to build metadata, which are not universally available locally. It is fully covered by pip-audit in CI.
  • Transitive dependency CVEs are covered by pip-audit in CI.

Files added / modified

File	Purpose
.github/workflows/security.yml	CodeQL + pip-audit CI jobs
.github/dependabot.yml	Weekly dependency update checks
.pre-commit-config.yaml	bandit SAST + pip-audit hooks (local)
requirements.txt	Direct dependencies for local pip-audit (mirrors setup.py install_requires)
README.md	Expanded Contributing/Development section with pre-commit setup instructions

Trigger conditions (CI)

• Push or PR to main
• Weekly schedule (Mondays 06:00 UTC)
• Manual via workflow_dispatch

Pre-existing findings

bandit surfaced the following in the existing codebase (not introduced by this PR):

• shell=True in subprocess calls (hints.py, setup.py, plasmashell.py, others) — CWE-78
• pickle.loads from a Unix domain socket (mouse.py, mouse_service.py) — CWE-502
• Hardcoded /tmp socket path (constants.py) — CWE-377

These are reported for the maintainer's awareness. The pre-commit hook runs only on staged files so it won't block existing workflows.

All tooling is free for public repositories — no external accounts or tokens required. All CI jobs have been validated on the fork before this PR.

[AlfredoSequeida]

Hey, thank you for the ci updates. I think this is a good idea to keep better code quality.

One suggestion: Can we change this to not used a requirements.txt file? I know that is very common place, but I rather keep the requirements in a single place instead of duplicating them and the requirements already exist as part of the setup.py file.

[ivan-pinatti]

Hi @AlfredoSequeida,

I agree that duplicating dependencies between requirements.txt and setup.py is not ideal.

This PR was mainly intended as a proof of concept to introduce the CI/code quality workflow and start the discussion around improving the project tooling. Longer term, I think it would make sense to migrate dependency management to a more modern and centralized approach, either fully using requirements.txt with pinned/dev dependencies separated properly, or preferably moving toward a pyproject.toml-based setup.

I’d be happy to collaborate on that refactor as a follow-up improvement if you think it fits the direction of the project.