Add CodeQL code scanning and extend Dependabot coverage (#29)

.github/dependabot.yml

@@ -9,3 +9,11 @@ updates:
     directory: "./tests/testsuite/roles/testing/files"
     schedule:
       interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "terraform"
+    directory: "./tests/setup"
+    schedule:
+      interval: "weekly"

.github/workflows/codeql.yml

@@ -0,0 +1,26 @@
+---
+name: "CodeQL"
+
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches: "**"
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  analyze:
+    runs-on: "ubuntu-22.04"
+    permissions:
+      security-events: "write"
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+    steps:
+      - uses: "actions/checkout@v4"
+      - uses: "github/codeql-action/init@v3"
+        with:
+          languages: "${{ matrix.language }}"
+      - uses: "github/codeql-action/analyze@v3"
+        with:
+          category: "/language:${{ matrix.language }}"

CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * [PERFORMANCE.md](./docs/PERFORMANCE.md), [SECURITY.md](./docs/SECURITY.md) and
   [RELIABILITY.md](./docs/RELIABILITY.md) documents in the documentation. (#93)
+* CodeQL code scanning workflow for Python static analysis. (#29)
+* Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 
 ### Changed
 

docs/SECURITY.md

@@ -119,3 +119,26 @@ sources.
 - Gunicorn (port 8088) binds to `localhost` only, accessible exclusively through the Nginx reverse proxy.
 - IPv6 should be disabled or configured to be non-routable to prevent unintended network exposure.
 - DNS resolution between nodes is required for InnoDB Cluster group replication and SSH connectivity.
+
+## Supply Chain Security
+
+### Code Scanning
+
+[CodeQL](https://codeql.github.com/) runs on every push and weekly via a scheduled workflow, performing static
+analysis on all Python source code. Results are reported to the GitHub Security tab under
+[Code scanning alerts](https://github.com/szachovy/superset-cluster/security/code-scanning).
+
+### Dependency Management
+
+[Dependabot](https://docs.github.com/en/code-security/dependabot) is configured to monitor and automatically
+propose updates for the following ecosystems on a weekly schedule:
+
+| Ecosystem | Directory | Scope |
+|-----------|-----------|-------|
+| `docker` | `./tests/setup` | Base image updates |
+| `pip` | `./tests/testsuite/roles/testing/files` | Python test dependencies |
+| `github-actions` | `/` | CI/CD action versions |
+| `terraform` | `./tests/setup` | Terraform provider versions |
+
+Dependabot alerts for known vulnerabilities are available in the
+[Security tab](https://github.com/szachovy/superset-cluster/security/dependabot).