Fix .github issues: bugs, security, inconsistencies, and gaps

[compwron]

Summary

Bugs / Broken

• autoapproval.yml: dependabot-preview → dependabot[bot] (old bot was shut down years ago)
• Issue templates (6 files): fix double-protocol Slack URLs (https:https:// → https://)
• npm_lint_and_test.yml: path trigger typo package.lock.json → package-lock.json (workflow was silently never firing on lockfile changes)

Security

• remove-helped-wanted.yml: pin andymckay/labeler@master → @1.0.4 (mutable ref is a supply-chain risk)

Inconsistencies

• factory_bot_lint.yml, rake-after_party.yml: Postgres 12.3 → 14.8 to match rspec.yml (factories were testing against a different DB version than specs)

Missed Opportunities

• codeql-analysis.yml: add ruby to language matrix (was JS-only; free Ruby security scanning was unused)
• dependabot.yml: add docker ecosystem to track base image updates (ruby:4.0.2-alpine, node:24-alpine, etc.)
• Add timeout-minutes to 9 workflows that had none (could hang indefinitely and burn CI minutes):
  • brakeman: 10 min
  • ruby_lint: 10 min
  • erb_lint: 10 min
  • spec_checker: 10 min
  • yaml_lint: 5 min
  • npm_lint: 10 min
  • factory_bot_lint: 15 min
  • rake-after_party: 15 min
  • codeql: 30 min

Other

• stale.yml: days-before-issue-close: 9999 → -1 (proper way to disable auto-close per stale action docs)

Test plan

• Verify CI passes on this PR
• Confirm Slack links in issue templates now work
• Confirm CodeQL runs for both javascript and ruby languages

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Pull request overview

This PR updates CASA’s GitHub configuration to fix a few broken CI triggers/links, reduce CI supply-chain risk, align workflow environments, and add missing security scanning coverage.

Changes:

• Add job-level timeout-minutes across several workflows to prevent indefinite CI hangs.
• Fix GitHub automation/config issues (Dependabot bot name, stale action config, workflow path trigger typo) and pin a mutable GitHub Action ref.
• Improve security/maintenance automation by enabling CodeQL for Ruby and adding Docker ecosystem updates to Dependabot.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/yaml_lint.yml	Adds a 5-minute job timeout for YAML linting.
.github/workflows/stale.yml	Disables issue auto-close correctly by using -1.
.github/workflows/spec_checker.yml	Adds a 10-minute job timeout.
.github/workflows/security.yml	Adds a 10-minute job timeout for Brakeman.
.github/workflows/ruby_lint.yml	Adds a 10-minute job timeout for StandardRB linting.
.github/workflows/remove-helped-wanted.yml	Pins andymckay/labeler to a fixed version instead of master.
.github/workflows/rake-after_party.yml	Adds timeout and aligns Postgres version to 14.8.
.github/workflows/npm_lint_and_test.yml	Fixes lockfile path trigger and adds a 10-minute timeout.
.github/workflows/factory_bot_lint.yml	Adds timeout and aligns Postgres version to 14.8.
.github/workflows/erb_lint.yml	Adds a 10-minute job timeout.
.github/workflows/codeql-analysis.yml	Adds timeout and enables CodeQL scanning for Ruby in addition to JavaScript.
.github/dependabot.yml	Adds Docker ecosystem updates.
.github/autoapproval.yml	Updates Dependabot owner identifier to dependabot[bot].
.github/ISSUE_TEMPLATE/problem_validation.md	Fixes malformed Slack invite URL.
.github/ISSUE_TEMPLATE/flaky_test.md	Fixes malformed Slack invite URL.
.github/ISSUE_TEMPLATE/feature_request.md	Fixes malformed Slack invite URL.
.github/ISSUE_TEMPLATE/documentation.md	Fixes malformed Slack invite URL.
.github/ISSUE_TEMPLATE/chore.md	Fixes malformed Slack invite URL.
.github/ISSUE_TEMPLATE/bug_report.md	Fixes malformed Slack invite URL.