Enhance GitHub Actions workflows and Dependabot configuration

- Pin ShellCheck action to v2.0.0 instead of using @master
- Update Dependabot config with comprehensive settings:
  - Add labels, commit message prefixes, and PR limits
  - Configure versioning strategy and branch naming
  - Add scheduling for weekly updates on Mondays
- Add new Python linting workflow with multiple linters:
  - Black, isort, Flake8, Pylint, and MyPy
  - Test against Python 3.9-3.12
- Add Docker Compose validation workflow
  - Validate syntax and check for potential secrets

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: challgren

.github/dependabot.yml

@@ -1,58 +1,75 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+# Dependabot configuration for automatic dependency updates
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
 version: 2
-
 updates:
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
+  # Python dependencies
+  - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
-    assignees:
-      - "challgren"
+      day: "monday"
+      time: "04:00"
+    open-pull-requests-limit: 5
     reviewers:
       - "challgren"
+    labels:
+      - "dependencies"
+      - "python"
+    commit-message:
+      prefix: "chore"
+      prefix-development: "chore"
+      include: "scope"
+    pull-request-branch-name:
+      separator: "/"
+    versioning-strategy: "increase"
     groups:
-      github-actions:
+      python-dependencies:
         patterns:
           - "*"
-        update-types:
-          - "minor"
-          - "patch"
+    # To ignore specific dependencies, uncomment and add them here:
+    # ignore:
+    #   - dependency-name: "package-name"
+    #     versions: ["x.x.x"]
 
-  # Maintain dependencies for Docker
+  # Docker dependencies
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
-    assignees:
-      - "challgren"
+      day: "monday"
+      time: "04:00"
+    open-pull-requests-limit: 5
     reviewers:
       - "challgren"
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     groups:
       docker-dependencies:
         patterns:
           - "*"
-        update-types:
-          - "minor"
-          - "patch"
 
-  # Maintain dependencies for pip
-  - package-ecosystem: "pip"
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
-    assignees:
-      - "challgren"
+      day: "monday"
+      time: "04:00"
+    open-pull-requests-limit: 5
     reviewers:
       - "challgren"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     groups:
-      python-dependencies:
+      github-actions:
         patterns:
-          - "*"
-        update-types:
-          - "minor"
-          - "patch"
+          - "*"

.github/workflows/docker-compose-lint.yml

@@ -0,0 +1,44 @@
+name: Docker Compose Lint
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - "docker-compose*.yml"
+      - ".github/workflows/docker-compose-lint.yml"
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - "docker-compose*.yml"
+      - ".github/workflows/docker-compose-lint.yml"
+
+jobs:
+  validate:
+    name: Validate Docker Compose files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate docker-compose.yml
+        run: docker compose -f docker-compose.yml config --quiet
+
+      - name: Validate docker-compose.proxy-test.yml
+        run: docker compose -f docker-compose.proxy-test.yml config --quiet
+        if: hashFiles('docker-compose.proxy-test.yml') != ''
+
+      - name: Check for secrets in compose files
+        run: |
+          # Check for potential secrets or sensitive data
+          for file in docker-compose*.yml; do
+            if [ -f "$file" ]; then
+              echo "Checking $file for potential secrets..."
+              if grep -iE "(password|secret|token|key|api).*[:=].*['\"]" "$file"; then
+                echo "Warning: Potential secrets found in $file"
+              fi
+            fi
+          done

.github/workflows/python-lint.yml

@@ -0,0 +1,66 @@
+name: Python Lint
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - "**.py"
+      - "requirements.txt"
+      - ".github/workflows/python-lint.yml"
+  push:
+    branches:
+      - main
+      - master
+    paths:
+      - "**.py"
+      - "requirements.txt"
+      - ".github/workflows/python-lint.yml"
+
+jobs:
+  lint:
+    name: Python Linting
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install flake8 black isort mypy pylint
+
+      - name: Run Black (format check)
+        run: black --check --diff app.py
+        continue-on-error: true
+
+      - name: Run isort (import sorting)
+        run: isort --check-only --diff app.py
+        continue-on-error: true
+
+      - name: Run Flake8 (style guide)
+        run: |
+          # Stop the build if there are Python syntax errors or undefined names
+          flake8 app.py --count --select=E9,F63,F7,F82 --show-source --statistics
+          # Exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
+          flake8 app.py --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
+
+      - name: Run Pylint
+        run: pylint app.py --exit-zero --max-line-length=127
+        continue-on-error: true
+
+      - name: Run MyPy (type checking)
+        run: mypy app.py --ignore-missing-imports
+        continue-on-error: true

.github/workflows/shellcheck.yml

@@ -27,7 +27,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@master
+        uses: ludeeus/action-shellcheck@2.0.0
         with:
           scandir: "./rootfs"
           severity: warning