ci: upgrade pipeline to ASM quality standard

[Cramraika]

Summary

• Add permissions (contents: read) for security
• Add paths-ignore for docs/config changes
• Add security audit step (pip-audit, advisory, non-blocking)
• Add environment validation
• Add CI summary with markdown table
• Improve flake8 lint configuration

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Enhanced continuous integration workflow with expanded code quality and security checks, including automated dependency audits.
  • Improved Docker build process with enhanced tracking and image tagging capabilities.
  • Added automated CI results summary reporting for improved visibility into build validation and security status.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 17199918-b941-4a8e-93b2-b33f2ea52eed

📥 Commits

Reviewing files that changed from the base of the PR and between 7cffeb8 and bd44fb3.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The CI workflow is expanded from a basic linting job to a comprehensive quality gates system. Changes include Python dependency caching, flake8 linting enhancements, pip-audit security scanning, environment validation checks, Docker image tagging with commit SHA, and a new summary job that reports results to GitHub.

Changes

Cohort / File(s)	Summary
CI Workflow Expansion .github/workflows/ci.yml	Reorganized ci job with added caching, expanded linting (flake8 with broader selectors), security audit (pip-audit), and environment validation. Docker build step now includes ID and SHA-based image tagging. New summary job generates markdown report of lint, security, and Docker build results to GitHub step summary.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 With whiskers twitching bright,
The workflow runs through quality night,
Caches are built, audits take flight,
Docker and lint in perfect sight,
A summary hops out—all tests done right! ✨

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch chore/ci-upgrade

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}