[Jules-GP]

Why

The server holds confidential imaging and its CI only ran the test suite. This adds the checks the Slicer client already runs, and hardens the existing workflows.

Added: security.yml (pull requests, pushes to main, weekly)

• secrets (gitleaks): the whole history, from the image pinned by digest (gitleaks-action needs a paid licence on an organisation). The nine hits it found are placeholders in server/README.md (Bearer your-...-token) and the word "tokens" in prose; they are listed one fingerprint each in .gitleaksignore, so a real secret is still reported.
• python (bandit): medium severity and up fails. Tests and benchmarks are excluded. B608 (SQL from strings) is skipped: there is no SQL database, and every hit was an HTML page assembled from constants. The eleven other hits were false positives, each now marked # nosec <rule> with its reason on the line above (fixed https URLs, the default TEMP_DIR, the agent compiling its own release_diff.py, the operator's own --restart-cmd).
• dependencies (pip-audit): server/requirements-api.txt, which is all the server image installs. Currently clean.
• workflows (zizmor): offline audit of the workflows themselves.

Added: codeql.yml and dependabot.yml

• CodeQL for Python and Actions, security-extended, results in the Security tab. Free on a public repository.
• Dependabot for GitHub Actions only, monthly and grouped, to keep the commit pins current.

Hardened: tests.yml and server-image.yml

zizmor reported nine findings; all are fixed:

• every action is pinned to a commit SHA (with its tag as a comment);
• persist-credentials: false on every checkout, so no git token sits in the workspace a build reads;
• server-image.yml no longer interpolates secrets.GITHUB_TOKEN and github.actor into the shell script; they go through env.

Checked locally

zizmor: no findings. bandit: clean. gitleaks: no leaks. pip-audit: no known vulnerabilities. Server suite: 1495 passed, known test_dev_mounts failure unchanged.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.