CRITICAL: Establish Automated CI Workflow for Security and Dependency Scanning

[basantnema31]

Description

The repository currently lacks a comprehensive, automated Continuous Integration (CI) workflow specifically dedicated to security and dependency scanning (e.g., using GitHub Actions with Dependabot, CodeQL, or npm audit). This is a critical omission, as the project might unknowingly merge code with known vulnerabilities or outdated, insecure dependencies.

Impact

• High risk of introducing security vulnerabilities through dependencies.
• Manual verification is prone to human error, scaling poorly as the project grows.
• Technical debt accumulation due to unmonitored dependency graphs.

Proposed Solution

1. Integrate an automated dependency scanning tool (e.g., Dependabot or Snyk) into the CI pipeline.
2. Configure automated PR generation for critical security updates.
3. Set up CodeQL or similar static application security testing (SAST) to run on every PR to \main.

I would like to take this up and set up a robust, automated security scanning pipeline for the repository.

/assign

Labels: gssoc, quality:exceptional, level:critical

[github-actions]

Thank you for raising this issue!

We'll review it as soon as possible. We truly appreciate your contributions! ✨

Meanwhile make sure you've visited the README.md, CONTRIBUTING.md, and CODE_OF_CONDUCT.md before creating a PR for this. Also, please do NOT create a PR until this issue has been assigned to you. 😊