[cedaraspen]

The repository lacks CODEOWNERS, scheduled dependency updates, and a source-controlled workflow for CodeQL security scans.

Add ownership for workflows, package and lock files, Yarn configuration, build configuration, plugins, and scripts. Configure weekly Dependabot updates for actions and npm dependencies. Group minor and patch updates for Docusaurus packages.

Add CodeQL scans for GitHub Actions and JavaScript/TypeScript. The scanner uses pinned actions, does not install dependencies or run the application build, and grants only contents: read and security-events: write.

Validation: actionlint v1.7.12 and git diff --check pass. Parsed configuration checks confirm both Dependabot ecosystems and the two CodeQL languages. The global commit hook reported a TruffleHog timeout, so its output is not a completed secrets scan. GitHub CI passed the documentation build and both CodeQL scans.

Manual setting required: CODEOWNERS requests do not enforce review by themselves. Enable required code-owner review in the main ruleset and restrict its bypass actors. Review or merge the CI isolation fix first: #247

Existing critical dependency fixes already have separate Dependabot PRs: #225 for shell-quote and #233 for proxy-addr. This change does not duplicate them or merge them.

Full findings and manual settings:
https://docs.google.com/document/d/1qtpWXQq9lNAg10VpBzmPFddoo0xdJJL4AUZyAlTo4iE

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.