ci: add Dependabot security updates and a weekly dependency audit

[rqbazan]

Summary

brand had no known vulnerabilities, so this PR changes no dependency. It only adds the maintenance files that keep it at zero: Dependabot security updates and a weekly dependency audit.

 .github/
+├── dependabot.yml                # security PRs only, npm + github-actions at "/"
 ├── workflows/
 │   ├── ci.yml
+│   ├── dependency-audit.yml      # weekly `pnpm audit`, one issue while findings remain
 │   ├── release.yml
 │   └── workflow-audit.yml
 └── zizmor.yml                    # + dependabot-cooldown: days: 1

What was vulnerable

Package	Severity	Runtime/dev	Path	Fix
None	–	–	–	–

pnpm audit on pnpm-lock.yaml reports nothing. The package has no runtime dependencies; only @changesets/cli and @changesets/changelog-github as devDependencies, plus the IBM Plex fonts as peers.

Maintenance files

• .github/dependabot.yml: npm and github-actions at /. open-pull-requests-limit: 0 keeps version updates off, so Dependabot opens security PRs only, grouped into one security group. cooldown.default-days: 1 mirrors pnpm's minimumReleaseAge: 1440. GitHub applies the cooldown to version updates only, so check the fixed version's age before merging a security PR.
• .github/workflows/dependency-audit.yml: runs pnpm audit every Monday at 09:00 UTC and on workflow_dispatch. It is not a pull_request check, so a new advisory never blocks an unrelated PR. While findings remain it opens or comments on one issue labeled dependency-audit, and it closes that issue on the first clean run.
• .github/zizmor.yml: the dependabot-cooldown rule expects 1 day, matching the config above.

Overrides and changesets

• Overrides: none.
• Changeset: none. The package publishes skills, tokens, assets, templates and BRAND-USE.md, and this PR touches only .github/. AGENTS.md says CI changes carry no changeset. changeset-bot will comment, but it is not a required check.

Org settings

The dependency graph is off for this repo, so Dependabot shows no alerts and opens no security PRs yet. An org admin enables the dependency graph and Dependabot security updates separately. Until then, the weekly audit is what verifies the zero.

Evidence

• Before: pnpm audit → No known vulnerabilities found (exit 0). No Dependabot config and no scheduled audit.
• After:
  • Dry run of the audit step from the repo root: RUNNER_TEMP=$(mktemp -d) GITHUB_OUTPUT=/dev/stdout bash -e -o pipefail step.sh → found=false, with an empty report. With the audit line swapped for false, the same script prints found=true and writes the report section, so a failing audit does reach the issue.
  • pipx run --spec zizmor==1.30.1 zizmor --offline . → No findings to report. Good job! (2 suppressed).
  • CI commands from ci.yml: pnpm install --frozen-lockfile and pnpm check pass, with pnpm 10.30.3 from mise.

Merge Danger

Door: two-way

Reverting this PR removes all three files.

Blast Radius: none

No published file, dependency or required check changes. The new workflow runs only on its schedule or by hand, and its token can only read contents and write issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TkHa1BVnm277qEiEuipG6n

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6538c80

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR