chore(ci): add dependency audit and Dependabot

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: 'uv'
+    # uv workspace root: one uv.lock covers every packages/* member.
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    cooldown:
+      default-days: 7
+  - package-ecosystem: 'github-actions'
+    # '/' covers .github/workflows only; the composite actions pin their own actions.
+    directories:
+      - '/'
+      - '/.github/actions/*'
+    schedule:
+      interval: 'weekly'
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -23,6 +23,18 @@ jobs:
       - run: uv run ruff check .
       - run: uv run ruff format --check .
 
+  # ─── Dependency audit ───────────────────────────────────────────────────────
+  audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      # Audits the committed uv.lock as-is (no `uv lock` first), so a vulnerable pin fails here.
+      - run: make audit
+
   # ─── Setup ──────────────────────────────────────────────────────────────────
   setup:
     name: Install & sync

Makefile

@@ -1,4 +1,11 @@
-.PHONY: start test typecheck lint format format-check lint-fix build clean
+.PHONY: start test typecheck lint format format-check lint-fix build clean audit
+
+# Report known vulnerabilities in the locked dependency set (pip-audit on uv.lock)
+# Exports to a file, not a pipe: make's /bin/sh has no pipefail, so a failed export would audit nothing and pass
+audit:
+	reqs=$$(mktemp) && trap 'rm -f "$$reqs"' EXIT && \
+	uv export --all-packages --no-emit-workspace --frozen -q -o "$$reqs" && \
+	uvx pip-audit@2.9.0 --disable-pip --no-deps -r "$$reqs"
 
 # Run main.py (uv run python main.py)
 start: