updated codeql and dependabot

.github/dependabot.yml

@@ -0,0 +1,20 @@
+
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://help.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+  # Maintain dependencies for gemfile/gemspec
+  - package-ecosystem: "bundler"
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,55 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository. You may wish to alter this file to override
+# the set of languages analyzed, or to provide custom queries or build logic.
+
+name: "Jekyll CI"
+
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on push or pull request events but only for the main branch
+  push:
+    branches: [ master ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+  # Triggers the workflow on push or pull request events but only for the main branch
+  schedule:
+    # Runs at 6am UTC every Monday
+    - cron: '0 6 * * 1'
+
+
+jobs:
+  # Check the Jekyll itself for errors and syntax
+  build:
+    name: Jekyll Build
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+    # Check that the Jekyll can actually build
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Build the site in the jekyll/builder container
+        run: |
+          docker run \
+          -v ${{ github.workspace }}:/srv/jekyll -v ${{ github.workspace }}/_site:/srv/jekyll/_site \
+          jekyll/builder:latest /bin/bash -c "chmod -R 777 /srv/jekyll && jekyll build --future"
+
+  # Then check the markdown files are properly formatted
+  analyse:
+    name: Markdown Lint
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+    # Check markdown files are markdown-lint compliant
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Lint markdown files with markdown-lint
+        uses: articulate/[email protected]
+        with:
+          # Includes some specific rules to ignore
+          config: .github/workflows/markdownlint-config.json
+          # Ignore the built website, might have some funky files
+          ignore: _site/
+          # Try to fix basic errors
+          fix: true

.github/workflows/greetings.yml

@@ -0,0 +1,21 @@
+
+name: Greetings
+
+on: [pull_request, issues]
+
+jobs:
+  greeting:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+    - uses: actions/first-interaction@v1
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: >-
+          Thanks for submitting an issue! I'll check it at as soon as possible
+          and get back to you.
+        pr-message: >-
+          Thanks for submitting a PR. If the PR is a valid and passes
+          all the checks , we will approve it soon. Have a great day !

.github/workflows/markdownlint-config.json

@@ -0,0 +1,7 @@
+{
+  "default": true,
+  "line-length": false,
+  "no-trailing-punctuation": {
+    "punctuation": ".,;:"
+  }
+}

Gemfile.lock

@@ -128,7 +128,7 @@ GEM
     trollop (2.9.9)
     tzinfo (1.2.9)
       thread_safe (~> 0.1)
-    tzinfo-data (1.2021.3)
+    tzinfo-data (1.2021.5)
       tzinfo (>= 1.0.0)
     unicode-display_width (1.8.0)
     wdm (0.1.1)

README.md

@@ -40,6 +40,14 @@ $ bundle exec jekyll serve
 ```
 Start the server locally at http://127.0.0.1:4000/ or http://localhost:4000/
 
+### Security 
+
+We use codeQL and dependabot alerts for vulnerabality analysis & fixes.
+
+```sh
+$ bundle audit
+```
+
 ### Deploy your devlopr-jekyll blog - One Click Deploy
 
 [![Deploy with ZEIT Now](https://zeit.co/button)](https://zeit.co/new/project?template=https://github.com/sujaykundu777/devlopr-jekyll)