GitHub Security: Dependabot, Code Scanning & Secrets

Dependabot Alerts & Version Updates

Dependabot monitors your dependencies for known vulnerabilities and can automatically open PRs to update them.

# .github/dependabot.yml
version: 2
updates:
  # npm dependencies
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
      time: "09:00"
      timezone: "Europe/London"
    open-pull-requests-limit: 5
    groups:
      dev-dependencies:
        dependency-type: "development"
      aws-sdk:
        patterns: ["@aws-sdk/*"]
    ignore:
      - dependency-name: "lodash"
        versions: ["4.x"]
    labels:
      - "dependencies"
    reviewers:
      - "alice"
    commit-message:
      prefix: "chore"

  # GitHub Actions
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "monthly"

Dependabot Security Updates

• Enable in: Settings → Security → Dependabot → "Dependabot security updates"

• Automatically opens PRs for dependencies with known CVEs

• Grouped security updates (beta): combines multiple updates in one PR

• Dependabot alerts: view all known vulnerabilities without auto-PRs

• Dismiss alerts: mark as false positive, used in tests only, or tolerable risk

Code Scanning (CodeQL)

# .github/workflows/codeql.yml
name: CodeQL Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 1 * * 1'  # Weekly Monday 1am

jobs:
  analyze:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read

    strategy:
      matrix:
        language: [javascript-typescript, python]

    steps:
      - uses: actions/checkout@v4

      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended  # security-and-quality for more checks

      - uses: github/codeql-action/autobuild@v3

      - uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
          upload: true

Secret Scanning

• Scans pushes for known secret patterns (AWS keys, GitHub tokens, Stripe keys, 200+ patterns)

• Blocks pushes containing secrets (with push protection enabled)

• Partner program: GitHub notifies providers (AWS, Stripe) automatically when their secrets are detected

• Custom patterns: define regex for your own secret formats

• Bypass: if you must push a test secret, use `git push --push-option=skip` or acknowledge in UI

# View secret scanning alerts
gh api /repos/owner/repo/secret-scanning/alerts | jq '.[] | {state, secret_type}'

# Resolve an alert
gh api /repos/owner/repo/secret-scanning/alerts/42 \
  --method PATCH \
  --field state=resolved \
  --field resolution=false_positive

SBOM & Supply Chain Security

# Generate SBOM (Software Bill of Materials)
gh api /repos/owner/repo/dependency-graph/sbom \
  --jq '.sbom.packages[].name' | head -20

# Dependency review in PRs (block PRs adding vulnerable deps)
# .github/workflows/dependency-review.yml

name: Dependency Review
on: [pull_request]
jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high
          deny-licenses: GPL-2.0, GPL-3.0