dev → main: v0.1.0 governance hardening, Phase 2 daemon, e2e showcase, dependabot bumps

.dockerignore

@@ -1,17 +1,52 @@
-.git
-__pycache__
-*.pyc
-*.pyo
-.pytest_cache
-.ruff_cache
-.mypy_cache
-site/
-media/
-reports/
-tooling/
-*.egg-info
-.venv
+# Dockerignore for Ardur builds
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.venv/
+venv/
+dist/
+build/
+*.egg
+
+# Go
+go/bin/
+go/pkg/mod/
+
+# Git
+.git/
+.gitignore
+.gitattributes
+
+# CI/CD
+.github/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# Agent state (local-only)
+.ardur/
+.vibap/
+.context/
+.agents/
+.ai-context/
+.agent-context/
+.codex/
+.claude/
+.local-skills/
+
+# Tests
+.pytest_cache/
+.coverage
+htmlcov/
+python/tests/test-results/
+
+# Misc
+node_modules/
 *.log
-*.jsonl
-*.jsonl.gz
 .env
+.env.*

.github/workflows/codeql.yml

@@ -30,7 +30,7 @@ jobs:
     outputs:
       languages: ${{ steps.detect.outputs.languages }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - id: detect
         name: Detect supported languages present in the tree
@@ -62,13 +62,12 @@ jobs:
       matrix:
         language: ${{ fromJSON(needs.detect-languages.outputs.languages) }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
-      # v3 is an annotated tag (tag-object 865f5f5c... → commit ce64ddcb...).
       # Pin to the commit SHA per the same discipline as the other
       # workflows; comment shows the human-readable version.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a  # v3 (commit)
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3 (commit)
         with:
           languages: ${{ matrix.language }}
           # `security-and-quality` is the broadest pack — covers
@@ -79,9 +78,9 @@ jobs:
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a  # v3 (commit)
+        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3 (commit)
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ce64ddcb0d8d890d2df4a9d1c04ff297367dea2a  # v3 (commit)
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v3 (commit)
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/hugo-site.yml

@@ -31,7 +31,7 @@ jobs:
       HUGO_VERSION: 0.161.1
       HUGO_PARAMS_SOURCEREF: ${{ github.sha }}
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
 
       - name: Verify source-backed Hugo mirrors
         run: |
@@ -71,6 +71,9 @@ jobs:
             exit 1
           fi
 
+      # Dev pushes validate and build the site only. The public hosted site is
+      # refreshed from main after reviewed release/main-promotion work, so the
+      # rendered source commit on github.io is the public freshness boundary.
       - name: Upload Pages artifact
         if: github.ref == 'refs/heads/main'
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5.0.0