chore(ci): expand Dependabot coverage + CodeQL actions + deps refresh

.github/dependabot.yml

@@ -15,16 +15,20 @@
 # specific language governing permissions and limitations
 # under the License.
 #
+# Every ecosystem update below uses a 7-day cooldown (all four
+# semver buckets set to 7) so a just-released version has a week to
+# settle (retags, withdrawals, upstream incident reports) before
+# Dependabot proposes bumping to it. This mirrors the same window
+# applied locally via `[tool.uv] exclude-newer = "7 days"` in the
+# root pyproject.toml and `exclude-newer-span = "P7D"` baked into
+# every tool's uv.lock.
 ---
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    # 7-day cooldown so a just-released action tag has a chance to
-    # settle (retags, withdrawal, CI incidents on the upstream) before
-    # Dependabot proposes bumping to it.
     cooldown:
       default-days: 7
       semver-major-days: 7
@@ -49,8 +53,11 @@ updates:
         patterns:
           - "*"
 
+  # Root framework project — currently just `prek` as a dev dep,
+  # tracked here so the version bound in pyproject.toml stays in
+  # step with upstream releases.
   - package-ecosystem: "uv"
-    directory: "/tools/vulnogram/generate-cve-json"
+    directory: "/"
     schedule:
       interval: "weekly"
     cooldown:
@@ -59,7 +66,77 @@ updates:
       semver-minor-days: 7
       semver-patch-days: 7
     groups:
-      generate-cve-json-deps:
+      framework-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/privacy-llm/checker"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      privacy-llm-checker-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/privacy-llm/redactor"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      privacy-llm-redactor-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/sandbox-lint"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      sandbox-lint-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/skill-evals"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      skill-evals-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/skill-validator"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      skill-validator-deps:
         patterns:
           - "*"
 
@@ -76,3 +153,31 @@ updates:
       oauth-draft-deps:
         patterns:
           - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/vulnogram/generate-cve-json"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      generate-cve-json-deps:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "uv"
+    directory: "/tools/vulnogram/oauth-api"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+      semver-major-days: 7
+      semver-minor-days: 7
+      semver-patch-days: 7
+    groups:
+      vulnogram-oauth-api-deps:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -32,7 +32,7 @@ permissions:
 
 jobs:
   analyze:
-    name: Analyze Python
+    name: "Analyze (${{ matrix.language }})"
     runs-on: ubuntu-24.04
     permissions:
       # Writing security-events is required for CodeQL to upload results to
@@ -41,6 +41,16 @@ jobs:
       contents: read
       security-events: write
 
+    strategy:
+      fail-fast: false
+      matrix:
+        # `python` covers the hand-written tools under `tools/`. `actions`
+        # is CodeQL's GitHub-Actions analyser — it inspects the workflow
+        # YAML in `.github/workflows/` for taint flows, secret exposure,
+        # and other CI-side vulnerabilities. It complements `zizmor.yml`
+        # (lint-style ruleset) with the deeper data-flow analysis.
+        language: [python, actions]
+
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -50,16 +60,14 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v4.35.2
         with:
-          languages: python
-          # The hand-written Python in this repo lives under
-          # `tools/{vulnogram/generate-cve-json,gmail/oauth-draft}/`. Both
-          # are stdlib-only / a single OAuth dep and do not process
-          # untrusted network input at runtime, so the default
-          # `security-and-quality` query suite is sufficient — no need
-          # for `security-extended`.
+          languages: ${{ matrix.language }}
+          # Neither the Python tools (stdlib-only / single OAuth dep, no
+          # untrusted network input at runtime) nor the workflow YAML
+          # warrants `security-extended`; the default
+          # `security-and-quality` suite is sufficient for both.
           queries: security-and-quality
 
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v4.35.2
         with:
-          category: "/language:python"
+          category: "/language:${{ matrix.language }}"

.pre-commit-config.yaml

@@ -34,7 +34,7 @@ repos:
       - id: check-hooks-apply
         name: Check if all hooks apply to the repository
   - repo: https://github.com/thlorenz/doctoc.git
-    rev: v2.2.0
+    rev: v2.4.1
     hooks:
       - id: doctoc
         name: Add TOC for Markdown and RST files
@@ -48,7 +48,7 @@ repos:
           - "--maxlevel"
           - "3"
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
+    rev: v6.0.0
     hooks:
       - id: check-merge-conflict
         name: Check that merge conflicts are not being committed
@@ -75,7 +75,7 @@ repos:
   # the hook never silently rewrites files; CI surfaces typos as
   # errors instead.
   - repo: https://github.com/crate-ci/typos
-    rev: v1.45.2
+    rev: v1.46.2
     hooks:
       - id: typos
         name: typos