ci: establish enterprise GitHub Actions automation baseline

.github/workflows/codeql.yml

@@ -1,23 +1,44 @@
 name: CodeQL
-
 on:
   push:
-    branches: [main]
   pull_request:
-    branches: [main]
   schedule:
-    - cron: "17 6 * * 1"
-
+    - cron: '23 3 * * 1'
 permissions:
   contents: read
   security-events: write
-
 jobs:
+  detect:
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.lang.outputs.languages }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: lang
+        shell: bash
+        run: |
+          set -euo pipefail
+          langs=''
+          [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python"
+          [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript"
+          [ -f go.mod ] && langs="$langs go"
+          [ -f Cargo.toml ] && langs="$langs rust"
+          [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin"
+          [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp"
+          [ -n "$langs" ] || langs=' python'
+          json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')"
+          echo "languages=$json" >> "$GITHUB_OUTPUT"
   analyze:
+    needs: detect
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.detect.outputs.languages) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: github/codeql-action/init@v4
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
         with:
-          languages: python
-      - uses: github/codeql-action/analyze@v4
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

.github/workflows/dependency-review.yml

@@ -0,0 +1,9 @@
+name: Dependency Review
+on: {pull_request:}
+permissions: {contents: read, pull-requests: read}
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/dependency-review-action@v4
+        with: {fail-on-severity: high}

.github/workflows/security.yml

@@ -0,0 +1,18 @@
+name: Security
+on:
+  push:
+  pull_request:
+  schedule: [{cron: '41 4 * * 1'}]
+permissions: {contents: read, security-events: write}
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: {fetch-depth: 0}
+      - uses: gitleaks/gitleaks-action@v2
+      - uses: aquasecurity/trivy-action@master
+        with: {scan-type: fs, scan-ref: ., format: sarif, output: trivy-results.sarif, ignore-unfixed: true, severity: HIGH,CRITICAL, exit-code: '1'}
+      - uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with: {sarif_file: trivy-results.sarif}