Add CI workflows, security scans, and dependabot

.github/dependabot.yml

@@ -0,0 +1,191 @@
+version: 2
+updates:
+  # GitHub Actions
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+
+  # Python dependencies — A2A agents
+  - package-ecosystem: pip
+    directory: /a2a/a2a_contact_extractor
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/a2a_currency_converter
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/cheerup_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/file_organizer
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/generic_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/git_issue_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/image_service
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/recipe_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/reservation_service
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/simple_generalist
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/slack_researcher
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/trivia_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /a2a/weather_service
+    schedule:
+      interval: weekly
+
+  # Python dependencies — MCP tools
+  - package-ecosystem: pip
+    directory: /mcp/cloud_storage_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/flight_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/image_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/movie_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/reservation_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/shopping_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/slack_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: pip
+    directory: /mcp/weather_tool
+    schedule:
+      interval: weekly
+
+  # Docker — A2A agents
+  - package-ecosystem: docker
+    directory: /a2a/a2a_contact_extractor
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/a2a_currency_converter
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/cheerup_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/file_organizer
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/generic_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/git_issue_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/image_service
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/recipe_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/reservation_service
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/simple_generalist
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/slack_researcher
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/trivia_agent
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /a2a/weather_service
+    schedule:
+      interval: weekly
+
+  # Docker — MCP tools
+  - package-ecosystem: docker
+    directory: /mcp/appworld_apis
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/cloud_storage_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/flight_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/github_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/image_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/movie_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/reservation_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/shopping_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/slack_tool
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directory: /mcp/weather_tool
+    schedule:
+      interval: weekly

.github/workflows/build.yaml

@@ -8,12 +8,12 @@ on:
   # Allows also to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   build-and-push:
-    # The type of runner that the job will run on
     runs-on: ubuntu-latest
-
-    # Grant GITHUB_TOKEN the permissions to write packages
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -64,24 +64,24 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a  # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd  # v4
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2  # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata for ${{ matrix.image_config.name }}
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf  # v6
         with:
           images: ghcr.io/${{ github.repository }}/${{ matrix.image_config.name }}
           tags: |
@@ -91,7 +91,7 @@ jobs:
             type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
 
       - name: Build and push ${{ matrix.image_config.name }}
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294  # v7
         with:
           context: ${{ matrix.image_config.path }}/${{ matrix.image_config.name }}
           file: ${{ matrix.image_config.path }}/${{ matrix.image_config.name }}/Dockerfile

.github/workflows/ci.yaml

@@ -1,45 +1,39 @@
 name: CI
 
 on:
-  # Triggers the workflow on push or pull request events but only for the "main" branch
   pull_request:
-    branches: [ "main" ]
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
-  build:
+  lint:
     runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        python-version: ["3.12"]
-
+    timeout-minutes: 10
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-
-      # Sets up a specific version of Python
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
         with:
-          python-version: ${{ matrix.python-version }}
-
-      # Installs dependencies
-      # It's a good practice to cache dependencies to speed up subsequent runs
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install flake8 pytest
-          if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-
-      # Lints with flake8
-      # This step checks for style issues in the code
-      - name: Lint with flake8
-        run: |
-          # stop the build if there are Python syntax errors or undefined names
-          flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-          # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-          flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-
-      # - name: Test with pytest
-      #   run: |
-      #     pytest
+          python-version: "3.12"
+      - name: Install ruff
+        run: pip install ruff==0.11.4
+      - name: Lint with ruff
+        run: ruff check .
+      - name: Check formatting with ruff
+        run: ruff format --check .
+
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        with:
+          python-version: "3.12"
+      - name: Install test dependencies
+        run: pip install pytest pydantic pydantic-settings httpx python-dotenv
+      - name: Run tests
+        run: python -m pytest -v

.github/workflows/scorecard.yaml

@@ -0,0 +1,35 @@
+name: Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "30 6 * * 1"  # Weekly Monday 6:30 AM UTC
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        with:
+          persist-credentials: false
+      - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 30
+      - uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98  # v4
+        with:
+          sarif_file: results.sarif