ci: add CodeQL SAST and pin pip dependencies with hashes (#10)

* ci: add CodeQL SAST workflow and pin pip dependencies with hashes

* ci: use requirements.in for CI installs (requirements.txt is hashed pinned)

Author: LF3551

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install -r requirements.txt
+        pip install -r requirements.in
         pip install pytest pytest-cov flake8 black mypy
         pip install -e .
     
@@ -94,7 +94,7 @@ jobs:
 
     - name: Check dependencies with safety
       run: |
-        pip install -r requirements.txt
+        pip install -r requirements.in
         safety check --json
       continue-on-error: true
 

.github/workflows/codeql.yml

@@ -0,0 +1,40 @@
+name: CodeQL SAST
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '20 3 * * 1'  # Every Monday at 03:20 UTC
+
+permissions: read-all
+
+jobs:
+  analyze:
+    name: Analyze Python
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+      with:
+        languages: python
+        queries: security-extended
+
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@dd746615b3b9d728a6a37ca2045b68ca76d4841a # v3.28.8
+      with:
+        category: "/language:python"

requirements.in

@@ -0,0 +1,26 @@
+# Core dependencies
+networkx>=3.0
+numpy>=1.24.0
+scipy>=1.10.0
+
+# CLI
+click>=8.1.0
+
+# Visualization
+matplotlib>=3.7.0
+pyvis>=0.3.2
+
+# Testing
+pytest>=7.4.0
+pytest-cov>=4.1.0
+
+# Data handling
+pandas>=2.0.0
+
+# Development
+black>=23.0.0
+mypy>=1.0.0
+flake8>=6.0.0
+
+# Security
+bandit>=1.7.0