ci: harden tooling and add security scanning

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   node:
     runs-on: ubuntu-latest
@@ -14,6 +17,8 @@ jobs:
         node-version: [22, 24]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v7
         with:
           node-version: ${{ matrix.node-version }}
@@ -28,7 +33,7 @@ jobs:
       - run: node scripts/verify-boundaries.mjs
       - run: node scripts/verify-subtrees.mjs
       - run: node scripts/verify-plans.mjs
-      - run: npx --yes @arethetypeswrong/cli --pack .
+      - run: npm run check:types
       - name: Smoke test the packed tarball
         run: |
           npm pack --pack-destination /tmp
@@ -37,7 +42,7 @@ jobs:
           cp scripts/smoke.mjs scripts/smoke.cjs scripts/types.ts scripts/copying-types.ts scripts/verify-copying.mjs scripts/verify-boundaries.mjs /tmp/consumer/
           cd /tmp/consumer
           npm init -y > /dev/null
-          npm install /tmp/sapientpro-json-stream-*.tgz
+          npm install --ignore-scripts /tmp/sapientpro-json-stream-*.tgz
           node smoke.mjs @sapientpro/json-stream
           node smoke.cjs @sapientpro/json-stream
           cp types.ts types.mts
@@ -54,14 +59,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: npm ci
       - run: npm run build
-      - run: bunx jest
+      - run: bun run --bun test --runInBand
       - run: bun scripts/smoke.mjs
       - run: bun scripts/verify.mjs
       - run: bun scripts/verify-copying.mjs
@@ -73,11 +80,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
-      - uses: denoland/setup-deno@v2
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed # v2.0.5
       - run: npm ci
       - run: npm run build
       - run: deno run --allow-read scripts/verify.mjs

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '23 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, actions]
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'

README.md

@@ -52,6 +52,7 @@ explicitly rejected. See [supported paths and streaming semantics](docs/v3.md#pa
 npm run build
 npm test -- --runInBand
 npm run check
+npm run check:types
 npm run test:formats
 npm run benchmark
 ```
@@ -65,6 +66,12 @@ scanner permits constant loop conditions because digit runs exit through explici
 bounds/character checks. Constructor-return shims in the compact-memory diagnostic
 have local, documented exceptions.
 
+`check:types` checks the packed package with the version locked in `package-lock.json`.
+CodeQL scans TypeScript/JavaScript and GitHub Actions on pull requests, main pushes
+and weekly. Dependabot checks npm dependencies and Actions weekly. Third-party
+Actions are pinned to commit SHAs; official GitHub Actions use version tags.
+See the [security policy](SECURITY.md) for private vulnerability reporting.
+
 Benchmarks include setup and use natural GC, serial workers and correctness checks. See [current throughput and reproduction](docs/performance.md). Detailed reports and raw samples stay in ignored `notes/`.
 The current implementation lives in `src/`, with tests in `tests/` and tools in
 `scripts/`. The 2.x implementation remains in its Git release tags rather than

SECURITY.md

@@ -0,0 +1,21 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report suspected vulnerabilities privately to
+[dmytro.kulyk@sapient.pro](mailto:dmytro.kulyk@sapient.pro).
+Please avoid public issues or pull requests that disclose an unpatched vulnerability.
+
+Include the affected package version, runtime, a minimal reproduction, and the
+expected security impact. For parser issues, include input and chunk boundaries,
+selectors, and relevant options. Remove credentials and other sensitive data.
+
+Reports are assessed by the maintainers. A fix and any public advisory will be
+coordinated with the reporter where possible. Response and remediation times are
+not guaranteed.
+
+## Versions
+
+Report issues affecting the latest stable 2.x release or the current 3.x
+prerelease. Prereleases are still under development; a fix may require upgrading
+to a newer prerelease. Older versions may require upgrading to receive a fix.