Update workflows + add dependabot

Author: cycomachead

.github/dependabot.yaml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: daily
+  open-pull-requests-limit: 10

.github/workflows/rspec.yml

@@ -10,11 +10,13 @@ jobs:
     runs-on: ubuntu-24.04
     services:
       postgres:
-        image: postgres:16
+        image: postgres:17
         env:
           POSTGRES_PASSWORD: password
         ports:
           - 5432:5432
+        options: --health-cmd="pg_isready" --health-interval=10s --health-timeout=5s --health-retries=3
+
     env:
       # Do not install production/staging-only gems in test environment
       BUNDLE_WITHOUT: "production staging"
@@ -27,18 +29,20 @@ jobs:
       CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
       QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
     steps:
+    - name: Install packages
+      run: sudo apt-get update && sudo apt-get install --no-install-recommends -y google-chrome-stable
     - uses: actions/checkout@v3
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
         bundler-cache: true
-    - name: Setup Database
-      run: |
-        bundle exec rails db:setup
     - name: Download and install Code Climate test reporter
       run: |
         curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
         chmod +x ./cc-test-reporter
+    - name: Setup Database
+      run: |
+        bundle exec rails db:test:prepare
     - name: Run before-build command
       run: ./cc-test-reporter before-build
     - name: Create Chrome data directory
@@ -50,7 +54,6 @@ jobs:
       env:
         CHROME_DATA_DIR: /tmp/chrome-data-rspec
         COVERAGE: "true"
-        CI: "true"
     # - name: Submit Legacy Code Climate Coverage Report
     #   if: env.CC_TEST_REPORTER_ID != ''
     #   run: |

.github/workflows/rubocop.yml

@@ -6,6 +6,22 @@ on:
   workflow_dispatch:
 
 jobs:
+  scan:
+    runs-on: ubuntu-latest
+    env:
+      # Do not install production/staging-only gems in test environment
+      BUNDLE_WITHOUT: "production staging default test"
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: .tool-versions
+          bundler-cache: true
+      - name: Scan for security vulnerabilities
+        run: bin/brakeman
+
   lint:
     runs-on: ubuntu-24.04
     env:
@@ -17,6 +33,7 @@ jobs:
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
+        ruby-version: .tool-versions
         bundler-cache: true
     - name: Run RuboCop
-      run: bundle exec rubocop
+      run: bin/rubocop