## Summary
This PR integrates security-focused checks into the existing quality gates and aligns local workflows with CI/CD execution.
## What changed
- Added Bandit to pre-commit backend checks.
- Integrated eslint-plugin-security into the existing frontend ESLint setup used by pre-commit.
- Added dedicated audit tasks:
- backend audit via pip-audit
- frontend audit via yarn npm audit
- Updated CI/CD workflow to include and gate on frontend/backend audit jobs.
- Switched backend vulnerability scanning from Safety to pip-audit to avoid interactive/auth requirements in CI.
- Updated backend dependency set and lockfile to resolve test dependency conflicts and keep the environment solvable.
- Marked backend integration API tests with the integration marker so marker-based unit/integration separation works consistently.
## Validation
- Pre-commit hooks run and pass after formatting/autofixes.
- Branch commit created successfully after hook-driven file updates.
- Branch pushed to remote and tracking is configured.
## Notes
- pip-audit now executes from backend context (for example via uv --directory backend run ...), matching project layout.
- Remaining reported vulnerabilities depend on upstream package fix availability/constraints and may require follow-up once publishable fix versions are consumable.
## Follow-ups (optional)
- Add a curated pip-audit ignore policy for non-actionable/transient advisories with rationale.
- Open a focused follow-up PR for remaining dependency advisories once upstream fixes are practically installable.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #74
This PR establishes a deterministic source-level quality gate before any build promotion and removes redundant post-build quality checks.
The new flow makes local developer workflow and CI behavior align:
- Developers run pre-commit locally (with auto-fix where appropriate)
- CI runs a check-only smoke gate to validate pre-commit cleanliness
- Build/test promotion only proceeds after source checks pass
## What Changed
### 1. Added a source-first quality gate
- Added a dedicated source gate workflow:
- `.gitea/workflows/cicd-source-checks.yaml`
- Gate now:
- Checks out target SHA
- Bootstraps backend/frontend toolchains
- Installs dependencies (`backend` via `uv`, `frontend` via `yarn`)
- Runs `pre-commit --all-files` as the quality smoke test
- Downstream build dispatch only occurs if this gate passes.
### 2. Updated pipeline routing
- `cicd-start.yaml` now dispatches the source gate first.
- `cicd-start.yaml` push trigger now includes all branches so feature branches run the same gate.
- Added explicit routing logs in dispatch steps (route decision, SHA, trace id) for easier debugging.
### 3. Removed redundant checks workflow
- Removed:
- `.gitea/workflows/cicd-checks.yaml`
- Updated:
- `.gitea/workflows/docker-build-main.yaml` now dispatches `cicd-tests.yaml` directly after successful main build.
### 4. CI check-only behavior vs local auto-fix behavior
Updated `.pre-commit-config.yaml` so hooks that can auto-fix behave as:
- **Local developer pre-commit**: auto-fix enabled
- **CI source gate**: check-only (no auto-fix)
Applied to:
- `ruff` / `ruff-format`
- `eslint`
- `prettier`
- `tsdoc-lint`
- `markdownlint`
- `pretty-format-toml`
This keeps CI as a true smoke validation of local pre-commit compliance.
### 5. Renovate workflow hardening
- Improved auth/token handling and diagnostics in:
- `.gitea/workflows/renovate.yml`
- Added support for internal/self-signed TLS endpoints used by this environment.
## Why
- Faster, earlier feedback on source quality failures
- Avoid expensive build/test progression when source hygiene fails
- Align CI with developer habits for predictable outcomes
- Remove duplicated quality checks and reduce pipeline complexity
## New Effective CI Flow
1. `cicd-start.yaml`
2. `cicd-source-checks.yaml` (pre-commit smoke gate)
3. `docker-build-base.yaml` / `docker-build-main.yaml`
4. `cicd-tests.yaml`
## Acceptance Criteria Mapping (Issue #60)
- Source-level lane runs independently and consistently: **Implemented**
- Source-lane failure blocks promotion: **Implemented**
- Outputs/logging are clear and actionable: **Implemented**
## Notes
- Source gate is intentionally check-only in CI.
- Developers should continue running local pre-commit before pushing.
- Any remaining failures in source gate indicate local pre-commit was not fully clean.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #71
## Summary
This PR tightens repository quality enforcement around markdown and documentation. It adds `markdownlint` to the `cicd-checks` workflow, expands pre-commit coverage so markdown files are checked repo-wide, and cleans up the PP-58 documentation set to keep it aligned with the new policy.
## What changed
- Added a `Markdownlint Check` entry to `.gitea/workflows/cicd-checks.yaml`
- Added `markdownlint` to pre-commit and widened prettier coverage to include markdown files across the repo
- Updated `README.md` to satisfy markdownlint line-length rules
- Normalized the PP-58 documentation set:
- `docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- `docs/adr/ADR003-deployable_runtime_image_contract.md`
- `docs/DEVELOPMENT.md`
- `docs/CICD_MULTI_STAGE_BUILD.md`
- `docs/CICD_TROUBLESHOOTING_GUIDE.md`
- `docs/SECURE_DOCKER_CICD.md`
## Validation
- `pre-commit run markdownlint --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- `pre-commit run prettier --files README.md docs/DEPLOYABLE_RUNTIME_CONTRACT.md`
- Workflow YAML validation returned no errors
## Notes
This change does not alter application runtime behavior. It only strengthens CI and documentation quality enforcement.
Co-authored-by: copilotcoder <copilotcoder@darkhelm.org>
Reviewed-on: #68
