feat: add comprehensive security workflow and enhance Dependabot configuration

[djach7]

• Add .github/workflows/security.yml with govulncheck vulnerability scanning and
  CodeQL analysis
• Configure security workflow to run on push/PR to main branch and daily schedule
• Enhance Dependabot configuration with automatic rebasing, PR limits, and
  consistent labeling
• Add commit message prefixes (deps: for Go modules, ci: for GitHub Actions)
• Set weekly update schedule with proper organization and filtering capabilities.

Closes #29

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly improves the repository's automated maintenance and security practices. It refines the Dependabot configuration to manage pull request volume more effectively and standardize commit messages for dependency updates. Concurrently, a new security workflow has been integrated to perform vulnerability scanning, adding a crucial layer of protection to the codebase.

Highlights

• Dependabot Configuration: Updated the .github/dependabot.yml file to include open-pull-requests-limit and commit-message prefixes for gomod and github-actions ecosystems, streamlining automated dependency updates.
• Security Workflow Integration: Introduced a new security workflow for vulnerability scanning, enhancing the repository's security posture by proactively identifying potential issues.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• .github/dependabot.yml
  • Added open-pull-requests-limit for gomod (5) and github-actions (3) ecosystems.
  • Configured commit-message prefixes ('deps' for gomod, 'ci' for github-actions).
  • Removed introductory comments.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/security.yml

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the dependabot.yml configuration. The changes to limit pull requests and set commit prefixes are good practice. However, the pull request description states that a 'security workflow' is being added, but no new workflow file is included in the changes. Please either add the security workflow file or update the pull request description to accurately reflect that only the Dependabot configuration is being updated. I have also added suggestions to automatically rebase Dependabot pull requests, which should reduce manual effort.

[djach7]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the dependabot.yml configuration, but it seems to be missing the security scanning workflow mentioned in the title and description. While the changes to Dependabot are useful, a separate security workflow file (e.g., for CodeQL) might have been intended but was not included. My review provides suggestions to further improve the Dependabot configuration by adding labels for better PR organization.

[djach7]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the dependabot.yml configuration to limit open pull requests and customize commit messages for Go modules and GitHub Actions. These are useful improvements for managing dependency updates. However, the pull request title and description indicate that a security scanning workflow should also be added, but this change appears to be missing from the current set of files. Please verify if the security workflow should be part of this PR.

[djach7]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the dependabot.yml configuration, enhancing the dependency update process for Go modules and GitHub Actions with features like pull request limits, auto-rebasing, and conventional commit messages. The changes to dependabot.yml are sound. However, the pull request title and description also mention adding 'security scanning', but no new security scanning workflow file is included in the changes. This might be a point of confusion and should be clarified or addressed in a separate PR. A suggestion has been made to refactor the dependabot.yml file using YAML anchors to improve maintainability by reducing configuration duplication.

[rosygmiki]

LGTM

[mmartinv]

Please add a descriptive commit message explaining the changes (or ask the AI to do it for you ;)

Other than that it LGTM

[kgiusti]

Good addition, thanks!

[semanticreleasebot-rmiki]

🎉 This PR is included in version 0.2.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀