ci(security): add informational security checks

.github/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/actionlint-sarif-template.txt

@@ -0,0 +1,63 @@
+{
+  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
+  "version": "2.1.0",
+  "runs": [
+    {
+      "tool": {
+        "driver": {
+          "name": "Actionlint",
+          "version": {{ getVersion | json }},
+          "informationUri": "https://github.com/rhysd/actionlint",
+          "rules": [
+            {{$first := true}}
+            {{range $ := allKinds}}
+            {{if $first}}{{$first = false}}{{else}},{{end}}
+            {
+              "id": {{json $.Name}},
+              "name": {{$.Name | toPascalCase | json}},
+              "defaultConfiguration": {
+                "level": "warning"
+              },
+              "fullDescription": {
+                "text": {{json $.Description}}
+              },
+              "helpUri": "https://github.com/rhysd/actionlint/blob/v1.7.12/docs/checks.md"
+            }
+            {{end}}
+          ]
+        }
+      },
+      "results": [
+        {{$first := true}}
+        {{range $ := .}}
+        {{if $first}}{{$first = false}}{{else}},{{end}}
+        {
+          "ruleId": {{json $.Kind}},
+          "level": "warning",
+          "message": {
+            "text": {{json $.Message}}
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": {{json $.Filepath}},
+                  "uriBaseId": "%SRCROOT%"
+                },
+                "region": {
+                  "startLine": {{$.Line}},
+                  "startColumn": {{$.Column}},
+                  "endColumn": {{$.EndColumn}},
+                  "snippet": {
+                    "text": {{json $.Snippet}}
+                  }
+                }
+              }
+            }
+          ]
+        }
+        {{end}}
+      ]
+    }
+  ]
+}

.github/actionlint.yml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+self-hosted-runner:
+  labels:
+    - linux-amd64-cpu8
+    - linux-amd64-gpu-rtxpro6000-latest-1
+    - linux-arm64-cpu8
+    - linux-arm64-gpu-l4-latest-1
+    - nv
+    - ubuntu-26.04
+    - windows-arm64
+    - wsl-amd64-gpu-rtxpro6000-latest-1
+
+paths:
+  .github/workflows/windows-msvc.yml:
+    ignore:
+      - 'constant expression "false" in condition'

.github/actions/setup-nix/action.yml

@@ -0,0 +1,24 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Setup Nix
+description: Install Nix and configure the OpenShell Cachix cache
+
+inputs:
+  cachix-auth-token:
+    description: Token used to write build outputs to Cachix
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      with:
+        github_access_token: ${{ github.token }}
+
+    - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+      with:
+        name: openshell
+        authToken: ${{ inputs.cachix-auth-token }}
+        skipPush: ${{ inputs.cachix-auth-token == '' }}

.github/codeql/codeql-config.yml

@@ -0,0 +1,15 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: OpenShell Rust and SDKs
+
+paths:
+  - crates
+  - examples
+  - sdk/go
+  - sdk/typescript/src
+  - python/openshell
+
+paths-ignore:
+  - python/openshell/_proto
+  - sdk/typescript/src/gen

.github/workflows/codeql.yml

@@ -0,0 +1,128 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: CodeQL
+
+on:
+  pull_request:
+  merge_group:
+    types: [checks_requested]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "29 5 * * 6"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: rust
+            build-mode: none
+          - language: go
+            build-mode: manual
+          - language: python
+            build-mode: none
+          - language: javascript-typescript
+            build-mode: none
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: sdk/go/go.mod
+          cache-dependency-path: sdk/go/go.sum
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Build Go SDK
+        if: matrix.language == 'go'
+        working-directory: sdk/go
+        run: go build ./...
+
+      - name: Analyze
+        id: analyze
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        with:
+          category: /language:${{ matrix.language }}
+          output: codeql-results
+          upload: never
+
+      - name: Summarize findings
+        if: always()
+        env:
+          LANGUAGE: ${{ matrix.language }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          shopt -s globstar nullglob
+          sarif_files=(codeql-results/**/*.sarif)
+
+          {
+            echo "### CodeQL: $LANGUAGE"
+            echo
+            if [ "${#sarif_files[@]}" -eq 0 ]; then
+              echo "No SARIF report was produced."
+            else
+              finding_count=$(jq -s '[.[].runs[]?.results[]?] | length' "${sarif_files[@]}")
+              echo "Findings: $finding_count"
+              echo
+              echo "Findings are informational and do not fail CI."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload SARIF to Code Scanning
+        if: steps.analyze.outcome == 'success'
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        with:
+          sarif_file: codeql-results
+          category: /language:${{ matrix.language }}
+
+      - name: Upload SARIF
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: codeql-${{ matrix.language }}-${{ github.run_id }}
+          path: codeql-results
+          if-no-files-found: ignore
+          retention-days: 14
+
+  result:
+    name: OpenShell / CodeQL (informational)
+    if: always()
+    needs: analyze
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Evaluate analyzer execution
+        env:
+          ANALYZE_RESULT: ${{ needs.analyze.result }}
+        shell: bash
+        run: |
+          if [ "$ANALYZE_RESULT" != "success" ]; then
+            echo "::error::One or more CodeQL analyzers did not complete successfully."
+            exit 1
+          fi
+          echo "All CodeQL analyzers completed; findings remain informational."

.github/workflows/dependency-review.yml

@@ -0,0 +1,98 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Dependency Review
+
+on:
+  pull_request:
+  merge_group:
+    types: [checks_requested]
+  workflow_dispatch:
+    inputs:
+      base_sha:
+        description: Base commit SHA to compare
+        required: true
+        type: string
+      head_sha:
+        description: Head commit SHA to compare
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    name: Dependency Review (informational)
+    runs-on: ubuntu-latest
+    env:
+      BASE_REF: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha || inputs.base_sha }}
+      HEAD_REF: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || inputs.head_sha }}
+    steps:
+      - name: Check Dependency Graph availability
+        id: preflight
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const shaPattern = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i;
+            const baseRef = process.env.BASE_REF;
+            const headRef = process.env.HEAD_REF;
+
+            if (!shaPattern.test(baseRef) || !shaPattern.test(headRef)) {
+              core.setFailed("Dependency Review requires base and head commit SHAs.");
+              return;
+            }
+
+            try {
+              await github.request(
+                "GET /repos/{owner}/{repo}/dependency-graph/compare/{basehead}",
+                {
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  basehead: `${baseRef}...${headRef}`,
+                  headers: {
+                    "X-GitHub-Api-Version": "2022-11-28",
+                  },
+                },
+              );
+              core.setOutput("available", "true");
+            } catch (error) {
+              const status = error.status;
+              if (status === 403 || status === 404) {
+                core.setOutput("available", "false");
+                core.warning(
+                  `GitHub Dependency Graph is unavailable (HTTP ${status}); Dependency Review is skipped.`,
+                );
+                await core.summary
+                  .addHeading("Dependency Review", 3)
+                  .addRaw(`GitHub Dependency Graph is unavailable (HTTP ${status}).`, true)
+                  .addRaw(
+                    "The informational review will start automatically once the repository feature is available.",
+                    true,
+                  )
+                  .write();
+                return;
+              }
+
+              const statusSuffix = status ? ` with HTTP ${status}` : "";
+              core.setFailed(
+                `Dependency Graph preflight failed${statusSuffix}: ${error.message}`,
+              );
+            }
+
+      - name: Review dependency changes
+        if: steps.preflight.outputs.available == 'true'
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
+          fail-on-severity: high
+          fail-on-scopes: runtime, development, unknown
+          warn-only: true
+          comment-summary-in-pr: never
+          license-check: false
+          show-openssf-scorecard: false