ci: upgrade pipeline to ASM quality standard

.github/workflows/ci.yml

@@ -1,28 +1,59 @@
+# =============================================
+# Bulk API Trigger - CI Pipeline
+# =============================================
+# Lint → Security Audit → Docker Build → Summary
+# =============================================
+
 name: CI
 
 on:
   push:
     branches: [main, master]
+    paths-ignore: ['*.md', 'docs/**', '.claude/**', '.vscode/**']
   pull_request:
     branches: [main, master]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  lint:
-    name: Lint
+  ci:
+    name: CI Quality Gates
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
         with:
           python-version: "3.11"
-      - name: Install linter
-        run: pip install flake8
-      - name: Run flake8
-        run: flake8 *.py --max-line-length=120 --count --select=E9,F63,F7 --show-source --statistics
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt flake8 pip-audit
+
+      - name: Lint (flake8)
+        id: lint
+        run: |
+          flake8 *.py --max-line-length=120 --count --show-source --statistics \
+            --select=E9,F63,F7,F82,E1,E4,W6
+
+      - name: Security audit (pip-audit)
+        id: security
+        continue-on-error: true
+        run: pip-audit --desc 2>&1 | head -50
+
+      - name: Validate environment
+        id: envcheck
+        run: |
+          [ -f "config.yaml" ] && echo "✅ config.yaml found" || echo "⚠️ config.yaml missing"
+          [ -f "Dockerfile" ] && echo "✅ Dockerfile found" || echo "⚠️ Dockerfile missing"
+          [ -f "requirements.txt" ] && echo "✅ requirements.txt found" || echo "❌ requirements.txt missing"
 
   docker-build:
     name: Docker Build
@@ -31,8 +62,26 @@ jobs:
       - uses: actions/checkout@v4
       - uses: docker/setup-buildx-action@v3
       - name: Build Docker image
+        id: docker
         uses: docker/build-push-action@v5
         with:
           context: .
           push: false
-          tags: bulk-api-trigger:test
+          tags: bulk-api-trigger:ci-${{ github.sha }}
+
+  summary:
+    name: CI Summary
+    runs-on: ubuntu-latest
+    needs: [ci, docker-build]
+    if: always()
+    steps:
+      - name: CI Summary
+        run: |
+          echo "## CI Results" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Lint + Security | ${{ needs.ci.result }} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Docker Build | ${{ needs.docker-build.result }} |" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Commit:** \`${GITHUB_SHA::7}\`" >> $GITHUB_STEP_SUMMARY