ci: add Brakeman and bundle-audit security scan job (#15169)

.github/workflows/run_foss_spec.yml

@@ -21,6 +21,24 @@ jobs:
       - name: Run Rubocop
         run: bundle exec rubocop --parallel
 
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+      - name: Run Brakeman
+        # Non-blocking for now: Brakeman surfaces 35 pre-existing findings
+        # (13 High confidence) that need security-team triage before this
+        # can be turned into a hard gate.
+        continue-on-error: true
+        run: bundle exec brakeman -q --no-pager
+      - name: Run bundle-audit
+        run: |
+          bundle exec bundle-audit update
+          bundle exec bundle-audit check
+
   lint-frontend:
     runs-on: ubuntu-latest
     steps:

Gemfile.lock

@@ -174,7 +174,8 @@ GEM
     bindex (0.8.1)
     bootsnap (1.16.0)
       msgpack (~> 1.2)
-    brakeman (5.4.1)
+    brakeman (8.0.5)
+      racc
     browser (5.3.1)
     builder (3.3.0)
     bullet (8.0.7)