From 800063ef17c892e4f60d83b19552121aa9559c96 Mon Sep 17 00:00:00 2001
From: Kenji TAKIGUCHI <waterfall_mouth@outlook.com>
Date: Tue, 27 Oct 2026 12:44:30 +0900
Subject: [PATCH] chore: configure free repository security automation

---
 .github/dependabot.yml                  | 23 +++++++++++++++++++++++
 .github/workflows/dependency-review.yml | 22 ++++++++++++++++++++++
 SECURITY.md                             |  7 +++++++
 3 files changed, 52 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/dependency-review.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..aed888a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+version: 2
+updates:
+- package-ecosystem: pip
+  directories:
+  - /
+  - /doc
+  schedule:
+    interval: weekly
+    day: monday
+    time: '10:00'
+    timezone: Asia/Tokyo
+  open-pull-requests-limit: 3
+  groups:
+    routine-updates:
+      patterns:
+      - '*'
+      update-types:
+      - minor
+      - patch
+    security-updates:
+      applies-to: security-updates
+      patterns:
+      - '*'
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..4f8ebb6
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,22 @@
+name: Dependency review
+'on':
+  pull_request:
+    types:
+    - opened
+    - synchronize
+    - reopened
+permissions:
+  contents: read
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout repository configuration
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      with:
+        persist-credentials: false
+        sparse-checkout: .github
+    - name: Review dependency changes
+      uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294
+      with:
+        fail-on-severity: high
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..bcb30c7
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# セキュリティ上の問題の報告
+
+脆弱性や認証情報の漏えいが疑われる場合は、公開のIssueやPRに詳細・秘密情報を書き込まず、
+このリポジトリの **Security → Advisories → Report a vulnerability** から非公開で報告してください。
+
+再現手順、影響するバージョン、影響範囲を、秘密情報の値を含めずに記載してください。
+対応時期やサポート対象についての個別の約束は、この文書では定めません。