[P0][C4] Add CodeQL SAST workflow for Python (required Scorecard check)

[POWDER-RANGER]

Problem

No SAST (Static Application Security Testing) workflow exists. The OpenSSF Scorecard SAST check requires an active code scanning tool (CodeQL, Semgrep, Bandit with upload, etc.) that uploads results to GitHub's security tab. Without it, this check scores 0/10.

Additionally, OBLISK handles cryptographic operations and multi-agent security logic — SAST is not optional for a security-focused framework.

Tasks

Create .github/workflows/codeql.yml

name: CodeQL Security Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '20 2 * * 3'  # Wednesday 02:20 UTC weekly

permissions:
  actions: read
  contents: read
  security-events: write

jobs:
  analyze:
    name: Analyze Python
    runs-on: ubuntu-latest
    timeout-minutes: 360

    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.0
        with:
          languages: python
          queries: security-extended,security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.0

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@ff0a06e83cb2de871e5a09832bc6a81e7276941f  # v3.28.0
        with:
          category: "/language:python"
          upload: true

Add Bandit as Secondary SAST Layer

• Add bandit to [project.optional-dependencies].dev in pyproject.toml
• Add Bandit to CI lint job:

  - name: Bandit security linter
    run: bandit -r oblisk/ -c pyproject.toml

• Configure Bandit in pyproject.toml:

  [tool.bandit]
  targets = ["oblisk"]
  skips = ["B101"]  # Allow assert in non-test code only if justified
  exclude_dirs = ["tests", "examples"]

• Fix all Bandit HIGH and MEDIUM severity findings
• Document any intentional skips with justification comments

Address Likely CodeQL Findings (proactive)

• Audit vault/vault.py for hardcoded credentials patterns
• Audit oblisk_cli.py for shell injection risks (subprocess calls)
• Audit any eval() / exec() usage in codebase
• Audit os.path usage for path traversal vulnerabilities
• Review all subprocess.run() calls — use shell=False always
• Check all pickle usage (avoid entirely, use json or msgpack)
• Verify no random module used for cryptographic purposes (use secrets or os.urandom)

Enable GitHub Advanced Security Features

• Enable Dependabot security alerts (already on via dependabot.yml)
• Enable Secret Scanning in repo settings
• Enable Push Protection to block committed secrets
• Review existing Security tab for any pre-existing alerts
• Set code scanning as required status check for PRs

CodeQL Custom Queries (optional, for max score)

• Create .github/codeql/ directory for custom query pack
• Write custom query: detect base64 used as encryption (catch regression of vault issue)
• Write custom query: detect hardcoded keys/passwords in test fixtures

Acceptance Criteria

• ✅ codeql.yml workflow exists and scans on push + weekly schedule
• ✅ CodeQL results visible in GitHub Security > Code Scanning Alerts
• ✅ Zero HIGH-severity CodeQL findings
• ✅ bandit -r oblisk/ exits 0 in CI
• ✅ Secret Scanning enabled and showing no alerts
• ✅ Push Protection enabled
• ✅ Scorecard SAST check shows 10/10
• ✅ CodeQL is a required PR status check (branch protection rule)

Scorecard Impact

Check	Before	After
SAST	0/10	10/10
Code-Review	partial	+1 (CodeQL required in branch protection)

Security Findings to Expect

Based on current code patterns, likely CodeQL/Bandit findings include:

• B110 — try/except pass (no-op exception handling) in agents
• B603/B607 — subprocess without shell=False in oblisk_cli.py
• Any os.system() calls (replace with subprocess.run([...], shell=False))
• Import of hashlib for anything other than non-cryptographic uses

Dependencies

Requires: #11 (SHA pinning framework)
Blocks: #13 (signed releases need CodeQL green)
Estimated effort: 3-4 hours

Priority: P0 — SAST is required Scorecard check
Labels: security, codeql, sast, scorecard, P0