Add dependabot feature

.github/dependabot.yml

@@ -0,0 +1,128 @@
+version: 2
+updates:
+  # Python pip dependencies in tutorials/03-multi-agent-systems/a2a_tutorial/beeai-a2a-client
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/a2a_tutorial/beeai-a2a-client"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    ignore:
+      - dependency-name: "beeai-framework"
+        # Ignore beeai-framework - causes Dependabot errors, blocking other updates
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python pip dependencies in tutorials/03-multi-agent-systems/a2a_tutorial/beeai-a2a-server
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/a2a_tutorial/beeai-a2a-server"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python pip dependencies in tutorials/03-multi-agent-systems/bee-ai-multi-agent-contract-management
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/bee-ai-multi-agent-contract-management"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python pip dependencies in tutorials/ai-agent-security
+  - package-ecosystem: "pip"
+    directory: "/docs/tutorials/ai-agent-security"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python projects with pyproject.toml - acp_tutorial
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/acp_tutorial"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python projects with pyproject.toml - multiagent-collab-cs-call-center-analysis
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/multiagent-collab-cs-call-center-analysis"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python projects with pyproject.toml - my_retail_advisor
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/my_retail_advisor"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # Python projects with pyproject.toml - crewai_agent_server
+  - package-ecosystem: "pip"
+    directory: "/tutorials/03-multi-agent-systems/acp_tutorial/crewai_agent_server"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "python"
+      - "tutorial"
+
+  # JavaScript/npm dependencies - silly_story_time
+  - package-ecosystem: "npm"
+    directory: "/tutorials/13-full-stack-applications/silly_story_time"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+    labels:
+      - "dependencies"
+      - "javascript"
+      - "tutorial"
+
+  # GitHub Actions (when workflows are added)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+
+# Made with Bob

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,42 @@
+name: CodeQL Security Analysis
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly on Monday at midnight UTC
+  workflow_dispatch:  # Allows manual triggering from Actions tab
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python', 'javascript' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v4
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+
+# Made with Bob

.github/workflows/dependabot-auto-approve.yml

@@ -0,0 +1,42 @@
+name: Dependabot Auto-Approve
+
+on: pull_request_target
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    # Only run for Dependabot PRs
+    if: github.actor == 'dependabot[bot]'
+
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v3
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Auto-approve patch and minor updates
+        # Auto-approve patch updates (1.2.3 -> 1.2.4) and minor updates (1.2.0 -> 1.3.0)
+        if: |
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor'
+        run: |
+          gh pr review --approve "$PR_URL" --body "Auto-approved ${{ steps.metadata.outputs.update-type }} update by Dependabot workflow"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on major updates
+        # Add comment for major updates that need manual review
+        if: steps.metadata.outputs.update-type == 'version-update:semver-major'
+        run: |
+          gh pr comment "$PR_URL" --body "⚠️ **Major version update detected** - This PR requires manual review before merging. Please review the changelog and test thoroughly."
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# Made with Bob

.github/workflows/dependency-review.yml

@@ -0,0 +1,24 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: always
+
+# Made with Bob

.github/workflows/python-security.yml

@@ -0,0 +1,62 @@
+name: Python Security Scan
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly on Monday at midnight UTC
+  workflow_dispatch:  # Allows manual triggering from Actions tab
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ['3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install security tools
+        run: |
+          pip install pip-audit safety bandit
+
+      - name: Run pip-audit
+        continue-on-error: true
+        run: |
+          echo "Running pip-audit on all requirements.txt files..."
+          find . -name "requirements.txt" -type f | while read req; do
+            echo "Auditing $req"
+            pip-audit -r "$req" || true
+          done
+
+      - name: Run Safety check
+        continue-on-error: true
+        run: |
+          echo "Running Safety check on all requirements.txt files..."
+          find . -name "requirements.txt" -type f | while read req; do
+            echo "Safety check for $req"
+            safety check -r "$req" || true
+          done
+
+      - name: Run Bandit security linter
+        continue-on-error: true
+        run: |
+          echo "Running Bandit security linter..."
+          bandit -r tutorials/ -ll -f json -o bandit-report.json || true
+
+      - name: Upload Bandit results
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: bandit-results-${{ matrix.python-version }}
+          path: bandit-report.json
+
+# Made with Bob

.github/workflows/secret-scan.yml

@@ -0,0 +1,30 @@
+name: Secret Scanning
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:  # Allows manual triggering from Actions tab
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.11'
+
+      - name: Install detect-secrets
+        run: pip install detect-secrets
+
+      - name: Run detect-secrets scan
+        run: |
+          detect-secrets scan --baseline .secrets.baseline .
+
+# Made with Bob