* ci: add semgrep SAST scanning to CI and pre-commit
Add semgrep static analysis to the security workflow and pre-commit
hooks. Uses `--config auto` for comprehensive coverage across Python,
Dockerfile, and GitHub Actions. The intentional `USER root` in the
Dockerfile (required for bind mount compatibility) is excluded via
`--exclude-rule`.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: pin semgrep container image to digest for zizmor
Pin semgrep/semgrep to sha256 digest (v1.151.0) to satisfy
zizmor's unpinned-images audit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ci: add zizmor pre-commit hook for Actions security audit
Matches the existing actionlint pattern — gracefully skips if zizmor
is not installed.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* ci: modernize tooling with prek, ty, and security scanning
Migrate from pre-commit to prek (Rust-native, faster hooks) and add
comprehensive CI improvements for code quality and security.
Changes:
- Replace pre-commit with prek for git hooks
- Add ty type checker (Rust-based, replaces mypy)
- Expand ruff rules: security (S), simplify (SIM), commented code (ERA)
- Add pip-audit workflow for Python dependency CVE scanning
- Add actionlint and zizmor for GitHub Actions linting/security
- Add ruff format check to CI
- Enable stricter ansible-lint rules (no-changed-when, risky-file-permissions)
- Remove obsolete Claude workflow files
- Apply ruff formatting fixes to test files
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): resolve actionlint install and ty type errors
- Use actionlint's official install script instead of broken URL pattern
- Exclude test mock modules from ty type checking
- Run workflows on push only for main/master to avoid duplicate PR runs
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): use glob pattern for actionlint, exclude all tests from ty
- actionlint requires *.yml glob, not directory path
- Exclude all tests from ty type checking (test code has looser typing)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): quote shell variables to fix shellcheck warnings
Fix SC2046/SC2086 warnings in workflow scripts:
- Quote $(uname -r) in apt-get install
- Quote $(pwd) in docker volume mount
- Quote $existing in gh issue comment
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix(ci): move key-order[task] to warn_list
Too many existing violations in the codebase to enable as error.
Move to warn_list for gradual fixes over time.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
