Add CI/CD enhancements: TypeScript checks, security scanning, and Dependabot

[abhishyantkhare]

Original Task

Set up comprehensive CI/CD and documentation. Detect the project type, add missing CI checks (ESLint, tests, linting), and generate CLAUDE.md and AGENTS.md files with coding standards and guidelines.

Changes

Files Created

• .github/workflows/typecheck.yml - TypeScript type-checking workflow

  • Runs on push to main and PRs
  • Uses yarn nx affected -t test:types to check affected packages
  • Follows existing CI patterns with Nx caching and Slack notifications
  • Only runs when TypeScript/TSX files or tsconfig files change

• .github/workflows/security.yml - Security scanning workflow

  • CodeQL analysis for JavaScript/TypeScript with security-extended queries
  • Dependency audit using yarn audit checking for critical vulnerabilities
  • Runs on push, PRs, and weekly scheduled scans (Mondays 9:00 UTC)
  • Matches existing workflow patterns with Slack failure notifications

• .github/dependabot.yml - Dependabot configuration

  • Weekly npm dependency updates with grouped production/development dependencies
  • Weekly GitHub Actions updates
  • Ignores major version updates (require manual review)
  • Adds appropriate labels and commit prefixes

Files Modified

• .gitignore - Enhanced with security patterns
  • Added *.pem for private key files
  • Added secrets/ directory
  • Added .env.local and .env.*.local patterns

Reviewed (No Changes Needed)

• CLAUDE.md / AGENTS.md - Already comprehensive with:
  • Project architecture overview
  • All important dev commands
  • Code style guidelines
  • Testing requirements and patterns
  • Common pitfalls and troubleshooting
  • File structure documentation

Implementation Notes

• All new workflows follow the existing patterns in ci.yml:

  • Same Node.js version (22.18.0)
  • Same caching strategies (Nx cache, dependency cache)
  • Same Slack notification pattern for main branch failures
  • Same concurrency groups to prevent duplicate runs

• TypeScript checking uses test:types target which maps to tsc --noEmit in packages that have it configured

• Security workflow runs CodeQL as a separate job from dependency audit to allow parallel execution and separate failure tracking