ci: GitHub Actions — test suites + SARIF/dashboard smoke

[PhysShell]

Первый CI в репозитории

До сих пор в репо не было ни одного workflow (оттого pre-merge checks были пустыми). OwnAudit — чистый Python (сам .NET/WPF-аудит STS гоняется на Windows-стенде, не тут), поэтому CI запускает build-free сьюты + смоук генерации отчётов. Без анализаторов, без .NET — быстро и детерминированно.

.github/workflows/ci.yml

Триггеры: pull_request + push в main; concurrency-отмена устаревших ранов; permissions: contents: read.

job test

• fix-arm: test_ai_fix + test_own_fix + test_orchestrate;
• report: test_sarif + test_baseline;
• перезапуск под -O — ловит регрессии от вырезания assert (все сьюты -O-safe by design).

job audit-report (needs test)

• экспорт GitHub-friendly SARIF + metrics.json / report.md (report.cli --min-level warning);
• смоук-сборка дашборда (build_dashboard.py) — у неё нет юнит-тестов, это ловит ошибки Python/JS-шаблона;
• выгрузка report/out/ артефактом.

В комментарии — рецепт загрузки полного SARIF в Security-вкладку (code scanning), когда гоняешь против самого STS-репо (тут пути находок указывают на внешнее дерево, поэтому пропущено).

Эффект

Этот PR сам себя проверит — на нём впервые появятся реальные зелёные чеки test и audit-report. Суммарно по веткам #7/#8 сейчас зелёные: 9/9 ai + 25/25 own + 7/7 wrapper + 14/14 sarif + 8/8 baseline.

🤖 Generated with Claude Code

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Added automated CI workflow for pushes to the main branch and all pull requests.
  • Runs test scripts in both normal and optimized Python modes for additional safety.
  • Generates audit reports (SARIF) and performs a dashboard build smoke test.
  • Uploads audit artifacts and fails if expected output is missing.
  • Uses read-only permissions and cancels in-progress runs for the same ref to improve efficiency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 268b36b1-036f-4a94-ad1e-14a9bcdc9124

📥 Commits

Reviewing files that changed from the base of the PR and between 77c6c44 and 4e13e03.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

Adds a GitHub Actions CI workflow for pushes to main and pull requests. It sets read-only repository permissions, runs Python 3.12 test scripts with a second python -O pass, and adds a dependent audit-report job that exports artifacts and uploads report/out/.

Changes

CI workflow

Layer / File(s)	Summary
Workflow controls .github/workflows/ci.yml	Sets the workflow name, push/PR triggers, read-only contents permissions, and concurrency cancellation keyed to github.ref.
Test job .github/workflows/ci.yml	Checks out the repo, installs Python 3.12, runs the fix/own/orchestrate and SARIF/baseline scripts, and reruns key tests under python -O.
Audit report job .github/workflows/ci.yml	Runs the dependent audit-report job, exports SARIF and report artifacts, performs the dashboard build smoke test, uploads report/out/, and leaves SARIF upload steps commented out.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

A bunny hopped through CI land,
with tests and audits close at hand.
main and PRs got a cheerful run,
reports and artifacts all spun.
🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: a new GitHub Actions CI workflow with tests and SARIF/dashboard smoke checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/sts-runtime-analysis-2mo4z9

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 24: Disable credential persistence on both actions/checkout steps in the
CI workflow so the checkout token is not left available before report/out is
uploaded. Update each checkout invocation to explicitly set persist-credentials
to false, using the existing actions/checkout usage in the workflow as the place
to make the change.
- Around line 38-44: The optimized CI rerun omits fix/tests/test_orchestrate.py,
so assert-stripping regressions in that suite are not covered. Update the -O
test step in the workflow to include test_orchestrate alongside the existing
fix/tests/test_ai_fix.py and fix/tests/test_own_fix.py reruns, using the same
PYTHONPATH=fix pattern so the optimized pass matches the normal suite coverage.
- Around line 24-25: The workflow is using mutable GitHub Actions tags, so
update the action references in the CI workflow to pinned commit SHAs instead of
version tags. Replace the uses of actions/checkout, actions/setup-python, and
actions/upload-artifact in the workflow with their full commit SHA references so
the CI definition stays immutable and reviewable.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 689a20cb-9c31-47bd-b1ae-eec316eaeb44

📥 Commits

Reviewing files that changed from the base of the PR and between a09b204 and 77c6c44.

📒 Files selected for processing (1)

• .github/workflows/ci.yml