[codex] v0.10.1 security and CI hardening

[lioneldyla]

Summary

• harden GitHub Actions with immutable SHA pins and least-privilege permissions
• remove unsafe container publishing and fake key-rotation workflows
• enforce complete workflow and Dependabot contract validation
• add strict Ruff, mypy, CLI tests, and dependency locking improvements
• release the corrected autonomous baseline as v0.10.1

Root cause

Remote commits introduced workflows and packaging assumptions that bypassed the repository security contracts, exposed secret-bearing build arguments, and made CI non-reproducible.

Impact

CI is deterministic and contract-checked, the local runtime remains autonomous, and no doctoral or external-project coupling is introduced.

Validation

• 189 pytest tests with warnings treated as errors
• Ruff checks
• mypy strict on 21 source files
• locked dependency synchronization
• dependency vulnerability scan
• tracked-secret scan
• git diff validation

Summary by Sourcery

Harden repository security, CI workflows, and DevSecOps contracts while releasing the autonomous preview as version 0.10.1.

New Features:

• Enforce strict validation of GitHub workflow inventory and Dependabot configuration through the DevSecOps platform.
• Add typed CLI port validation for the local preview API and corresponding tests.
• Introduce mypy as a first-class DevSecOps tool with strict type-checking across framework modules.

Bug Fixes:

• Align framework, API, manifests, registry, project metadata, and tests on the 0.10.1 version to restore consistency.
• Require project manifest versions and correct API route inspection to avoid invalid or incomplete registry mappings.
• Remove CI test steps and workflows that exposed secrets or performed unsafe container publishing and key rotation.

Enhancements:

• Centralize validation success messaging in the CLI and simplify core operation approval checks for consequential actions.
• Harden Docker Compose rendering tests to use the resolved docker binary and improve YAML loading safety.
• Tighten linting configuration with broader Ruff rule coverage and type stub dependencies for jsonschema and PyYAML.

Build:

• Update CI workflows to use immutable full-SHA action pins with least-privilege permissions and deterministic uv-locked environments.
• Refine DevSecOps manifests and registry to track dependency-updates as an explicit component and register mypy in the tool set.
• Extend devsecops lint script to run mypy alongside Ruff and shell syntax checks.

CI:

• Simplify the main CI workflow to focus on linting, security scanning, and dependency audit without secret-bearing test executions.
• Lock Dependabot to monitor uv and GitHub Actions ecosystems weekly with constrained options and PR limits.

Deployment:

• Remove Dockerfile-based builds and related GitHub workflows to keep the framework as a local, non-containerized preview.

Documentation:

• Rewrite the security policy to reflect verified GitHub controls, local API exposure constraints, and vulnerability reporting expectations.
• Document DevSecOps guarantees around workflow registration, Dependabot monitoring, and strict mypy coverage.
• Update README, release criteria, changelog, and project documentation to describe the 0.10.1 developer preview and its hardened contracts.

Tests:

• Add comprehensive DevSecOps tests for workflow registration, Dependabot ecosystem completeness, and configuration constraints.
• Introduce new CLI, Docker, and automation platform tests to validate port handling, compose rendering, and hardened contracts.
• Update platform, API, projects, and doctor tests to assert the 0.10.1 version and the expanded DevSecOps tool set.

Chores:

• Perform a repository-wide version bump from 0.10.0 to 0.10.1, including manifests, registries, scripts, and framework metadata.

[sourcery-ai]

Reviewer's Guide

Security-hardening and determinism improvements across CI, DevSecOps contracts, CLI, and project metadata to release corrected autonomous baseline v0.10.1, including strict typing/linting and workflow/dependency policy enforcement.

Sequence diagram for CLI validate command and platform contract checks

sequenceDiagram
    actor User
    participant cli_main as main
    participant parser as _parser
    participant validator as _validation_message
    participant devsecops as validate_devsecops_platform

    User->>cli_main: jdgf validate
    cli_main->>parser: _parser()
    parser-->>cli_main: argparse.ArgumentParser
    cli_main->>cli_main: parse_args()
    cli_main->>cli_main: load_project_registry(root)
    cli_main->>validator: _validation_message(root, project_count)
    validator->>devsecops: validate_devsecops_platform(root)
    devsecops-->>validator: DevSecOpsPlatformSummary
    validator-->>cli_main: validation_message
    cli_main->>User: print("JDGF validation passed: ...")
    cli_main-->>User: exit 0

Loading

Flow diagram for DevSecOps platform validation of workflows and Dependabot

flowchart TD
    A[validate_devsecops_platform] --> B[Load devsecops manifest]
    B --> C[Load devsecops registry]
    C --> D[Check components include dependency-updates]
    D --> E[Inventory .github/workflows]
    E --> F[Compare to expected_workflows]
    F --> G{Mismatch?}
    G -- Yes --> H[DevSecOpsPlatformError: workflow inventory differs]
    G -- No --> I[Load .github/dependabot.yml]
    I --> J[Validate version == 2]
    J --> K[Validate ecosystems == uv, github-actions]
    K --> L[Validate allowed keys and weekly schedule]
    L --> M[Validate tools include mypy]
    M --> N[Return DevSecOpsPlatformSummary]

Loading

File-Level Changes

Change	Details	Files
Refactored CLI validation flow and port parsing to simplify contract validation output and harden serve-port input.	Introduced a dedicated _port argparse type enforcing unprivileged port range and numeric input with clear error messages. Simplified validate command handling by extracting _validation_message that computes/prints platform summaries and exits early. Removed optimization-sensitive assert-based validation paths and always list registered projects after successful validation.	src/jdgf_framework/cli.py tests/test_cli.py
Strengthened DevSecOps platform validation to enforce workflow inventory, Dependabot contract shape, and tool registry completeness.	Reimplemented YAML base-loading using explicit BaseLoader instance with proper disposal for safer parsing. Added dependency-updates as a required DevSecOps component and validated actual workflow files match the registry inventory. Enforced Dependabot version 2 with only uv and github-actions ecosystems, constrained allowed keys, directory, and schedule. Expanded DevSecOps tools to include mypy and aligned registry, schema, and tests with the new tool set. Added tests for unregistered workflows and invalid Dependabot options/ecosystem sets.	src/jdgf_framework/devsecops_platform.py tests/test_devsecops_platform.py manifests/devsecops-platform.schema.yaml manifests/devsecops-platform.yaml registry/devsecops.schema.yaml registry/devsecops.yaml .github/dependabot.yml docs/DEVSECOPS_PLATFORM.md
Hardened CI and container workflows by pinning actions to SHAs, removing unsafe Docker publishing/key-rotation workflows, and delegating tests to existing scripts.	Pinned actions/checkout, actions/setup-python, and astral-sh/setup-uv to immutable SHAs in CI and container-contracts workflows. Removed secret-bearing environment variables and inline pytest invocation from CI in favor of scripts/devsecops/security-scan.sh. Removed docker-build and rotate-keys workflows and Dockerfile to eliminate unsafe publishing and non-functional key-rotation automation. Dropped docker compose validation from container-contracts workflow as coverage is now provided by test_docker_platform and related tests.	.github/workflows/ci.yml .github/workflows/container-contracts.yml .github/workflows/docker-build.yml .github/workflows/rotate-keys.yml Dockerfile scripts/devsecops/security-scan.sh
Enabled strict type checking and stronger linting across the codebase and DevSecOps tooling.	Added mypy, types-jsonschema, and types-PyYAML as development dependencies and configured strict mypy for src/jdgf_framework. Expanded Ruff lint rules to include security, bugbear, import, simplification, and modernization checks with per-file ignores for tests. Updated DevSecOps docs to mention strict mypy coverage and Dependabot monitoring. Wired mypy into the devsecops run-lint.sh script and DevSecOps tools registry to enforce CI typing checks.	pyproject.toml scripts/devsecops/run-lint.sh docs/DEVSECOPS_PLATFORM.md registry/devsecops.yaml registry/devsecops.schema.yaml
Released v0.10.1 by updating framework, API, project manifests, tests, and docs to the new version and fixing minor platform validation behaviors.	Bumped version from 0.10.0 to 0.10.1 across pyproject, init, VERSION, manifests, registry entries, install script, README, core tests, and API tests. Adjusted API platform route validation to tolerate routes with empty methods by defaulting to an empty set. Ensured project manifests validate metadata.version as a required string and updated JDGF project version fields/timeline. Clarified SECURITY policy in English, documenting verified controls, lack of branch protection, and local unauthenticated API constraints. Updated RELEASE_CRITERIA and CHANGELOG to describe the 0.10.1 security/CI corrections and autonomous baseline. Minor typing/import cleanups (e.g., collections.abc.Iterable, import ordering, yaml import layout, docker CLI detection) to satisfy new lint/mypy rules. Simplified core platform approval checks with a single conditional for mutating consequential operations.	pyproject.toml src/jdgf_framework/__init__.py VERSION README.md SECURITY.md CHANGELOG.md docs/RELEASE_CRITERIA.md install.sh manifests/framework.yaml manifests/api-platform.yaml projects/JDGF/project.yaml registry/api.yaml registry/projects.yaml tests/test_api_platform.py tests/test_core_platform.py tests/test_projects.py src/jdgf_framework/api_platform.py src/jdgf_framework/projects.py src/jdgf_framework/core_platform.py tests/test_docker_platform.py tests/test_automation_platform.py src/jdgf_framework/rag_runtime.py src/jdgf_framework/document_processing.py src/jdgf_framework/projects.py src/jdgf_framework/runtime_platform.py src/jdgf_framework/catalogs.py src/jdgf_framework/knowledge_platform.py tests/test_*

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.