[infra] CI security & type-safety gates: secret scanning + stricter tsconfig

[rahulkatiyar19955]

Severity

Medium

Summary

CI lacks secret-scanning and dependency review, and the TypeScript configs stop at strict without the higher-value extra checks that would catch undefined-access bugs in code parsing untrusted rosbag/IPC data. Both are mechanical safety nets that are cheap to add.

Findings

• No secret scanning anywhere in CI — .github/workflows/ — AGENT.md forbids committing secrets/.env and the app collects real provider API keys, but there is no gitleaks/trufflehog job, no dependency-review-action, and no enforced push-protection. A leaked key committed in a PR would not be caught pre-merge. fix: add a gitleaks (or trufflehog) job on PR/push, and enable Dependabot + dependency-review-action.
• tsconfig strictness stops at strict; missing high-value checks — tsconfig.node.json:9-12, tsconfig.web.json:10-13 — both enable strict + noUnusedLocals/noUnusedParameters/noFallthroughCasesInSwitch but omit noUncheckedIndexedAccess, exactOptionalPropertyTypes, noImplicitOverride, and noImplicitReturns. For an app indexing into arrays/records parsed from untrusted rosbag and IPC payloads, noUncheckedIndexedAccess in particular would surface many undefined-access bugs at compile time. fix: enable at least noUncheckedIndexedAccess and noImplicitOverride in both tsconfigs (consider the other two), and fix the resulting type errors.

Project-rule reference

AGENT.md ### Secrets (line 169) and ## Agent Instructions line 42 (never commit secrets/.env); ## Agent Instructions line 41 (TypeScript strict mode).