feat: add dependabot, scorecard, container build CI, and CI timeout

[pdettori]

Summary

Phase 4 of repo orchestration — completes the CI baseline. The repo already has strong ci.yaml and security-scans.yaml workflows; this PR fills the remaining gaps.

New files:

• .github/dependabot.yml: weekly automated dependency updates for:

  • GitHub Actions (SHA pins stay current)
  • Python/pip — root pyproject.toml
  • Python/pip — plugins/examples/nemocheck/pyproject.toml
  • Docker — root Dockerfile base image

• .github/workflows/scorecard.yml: OpenSSF Scorecard analysis

  • Triggers: push to main + weekly Monday schedule
  • Publishes results to GitHub Security tab and OpenSSF API (enables public badge)
  • All actions SHA-pinned

• .github/workflows/build.yml: container image build and push

  • Triggers: tag push (v*) and workflow_dispatch
  • Multi-arch: linux/amd64 + linux/arm64 via QEMU
  • Pushes to ghcr.io/kagenti/plugins-adapter
  • Supports optional plugin_deps input to bake in plugins at build time
  • GitHub Actions layer cache for faster rebuilds

Modified:

• .github/workflows/ci.yaml: add timeout-minutes: 15 to prevent hung CI jobs

What was already in place (not changed)

Workflow	Coverage
ci.yaml	lint (pre-commit/ruff), unit tests (server + nemocheck), Python 3.11/3.12 matrix
security-scans.yaml	dependency review, shellcheck, yamllint, hadolint, bandit, trivy, codeql, action pinning
stale.yaml	org reusable stale issue/PR workflow
self-assign.yml	org reusable self-assign workflow

Tier 3 (not included — optional)

• Comment-triggered E2E (e2e-pr.yml) — not needed unless integration tests are added
• Post-merge security SARIF upload — trivy already runs on PRs; post-merge upload can be added when Security tab is enabled

Test plan

• Dependabot PRs appear within a week of merge
• Scorecard workflow runs on merge to main (check Actions tab)
• build.yml runs successfully on workflow_dispatch
• CI matrix still passes (timeout added, no other changes)

[evaline-ju]

The build is a bit complicated for this repo currently but the other additions lgtm - perhaps we could leave that off for now?

[evaline-ju]

I'm currently testing a parallel of this (though not as generic) - image building here requires building some envoy protos which we've kept separately from the Dockerfile for now since the Python compilation was pretty messy

[pdettori]

Good call — removed build.yml in the latest commit. The PR now only contains dependabot.yml, scorecard.yml, and the timeout-minutes addition to ci.yaml.