003 stabilize GitHub actions

.github/actionlint.yaml

@@ -0,0 +1,45 @@
+# ==============================================================================
+# actionlint configuration for A.R.C. Platform
+# ==============================================================================
+# https://github.com/rhysd/actionlint
+#
+# This config makes actionlint ignore low-priority ShellCheck warnings in
+# GitHub Actions inline shell scripts.
+#
+# Rationale: CI/CD scripts are operational tooling, not production code.
+# They run in controlled environments where many ShellCheck warnings are
+# safe to ignore.
+# ==============================================================================
+
+# Self-hosted runners (if any)
+self-hosted-runner:
+  labels: []
+
+# Configuration variables available in the repository
+config-variables: []
+
+# Ignore specific ShellCheck rules across all workflow files
+# Uses regex patterns to match error messages
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # SC2086: Double quote to prevent globbing (safe in CI environment)
+      - 'shellcheck reported issue in this script: SC2086:.+'
+      # SC2129: Use { cmd1; cmd2; } >> file (style preference)
+      - 'shellcheck reported issue in this script: SC2129:.+'
+      # SC2046: Quote command substitution
+      - 'shellcheck reported issue in this script: SC2046:.+'
+      # SC2006: Use $() instead of backticks
+      - 'shellcheck reported issue in this script: SC2006:.+'
+      # SC2034: Unused variables (may be exported)
+      - 'shellcheck reported issue in this script: SC2034:.+'
+      # SC2116: Useless echo
+      - 'shellcheck reported issue in this script: SC2116:.+'
+      # SC2005: Useless echo
+      - 'shellcheck reported issue in this script: SC2005:.+'
+      # SC2170: Invalid number comparison (false positive in GitHub Actions)
+      - 'shellcheck reported issue in this script: SC2170:.+'
+      # SC2126: Use grep -c instead of grep|wc -l
+      - 'shellcheck reported issue in this script: SC2126:.+'
+      # SC2235: Use { ..; } instead of (..) to avoid subshell overhead
+      - 'shellcheck reported issue in this script: SC2235:.+'

.github/actions/README.md

@@ -0,0 +1,74 @@
+# A.R.C. Composite Actions
+
+Reusable composite actions for the A.R.C. Platform CI/CD pipeline.
+
+## Purpose
+
+Composite actions encapsulate repeated setup and utility steps, providing:
+- **Consistency**: Same setup across all workflows
+- **Maintainability**: Single source of truth for tool versions
+- **Efficiency**: Cached dependencies and tools
+
+## Available Actions
+
+| Action | Purpose | Used By |
+|--------|---------|---------|
+| `setup-arc-python/` | Python 3.11 + pip cache + tools (ruff, black, mypy) | pr-checks, main-deploy |
+| `setup-arc-docker/` | GHCR login + BuildKit + cache config | build, publish workflows |
+| `setup-arc-validation/` | Install hadolint, trivy, shellcheck | pr-checks, security workflows |
+| `arc-job-summary/` | Generate markdown job summaries | ALL workflows |
+| `arc-notify/` | Send notifications (Slack, GitHub Issues) | deploy, security workflows |
+
+## Usage Example
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: ./.github/actions/setup-arc-python
+        with:
+          python-version: '3.11'
+
+      - name: Setup Docker
+        uses: ./.github/actions/setup-arc-docker
+        with:
+          registry: ghcr.io
+```
+
+## Action Structure
+
+Each action follows this structure:
+
+```
+action-name/
+├── action.yml    # Action definition
+└── README.md     # Usage documentation
+```
+
+## Creating New Actions
+
+1. Create directory: `.github/actions/{action-name}/`
+2. Create `action.yml` with inputs, outputs, runs
+3. Create `README.md` with usage examples
+4. Test with minimal workflow before integrating
+
+## Version Pinning
+
+All external actions are pinned to SHA for security:
+
+```yaml
+# Good - pinned to SHA
+uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+# Acceptable - pinned to major version
+uses: actions/checkout@v4
+```
+
+## References
+
+- [GitHub Composite Actions Documentation](https://docs.github.com/en/actions/creating-actions/creating-a-composite-action)
+- [A.R.C. CI/CD Architecture](../../docs/architecture/CICD-ARCHITECTURE.md)

.github/actions/arc-job-summary/README.md

@@ -0,0 +1,137 @@
+# A.R.C. Job Summary
+
+Composite action to generate formatted job summaries with visual indicators.
+
+## Purpose
+
+Creates consistent, readable job summaries that appear on the GitHub Actions run page:
+- Visual status indicators (emojis)
+- Structured result tables
+- Links to runs and commits
+- Support for multiple summary types
+
+## Usage
+
+### Basic Usage
+
+```yaml
+steps:
+  - name: Generate Summary
+    uses: ./.github/actions/arc-job-summary
+    with:
+      status: success
+      title: 'Build Results'
+```
+
+### With Results JSON
+
+```yaml
+steps:
+  - name: Save results
+    run: |
+      cat > results.json << 'EOF'
+      {
+        "builds": [
+          {"service": "arc-sherlock-brain", "status": "success", "duration": "45s", "size": "445MB"},
+          {"service": "arc-scarlett-voice", "status": "success", "duration": "38s", "size": "412MB"}
+        ]
+      }
+      EOF
+
+  - name: Generate Summary
+    uses: ./.github/actions/arc-job-summary
+    with:
+      status: success
+      results-json: results.json
+      summary-type: build
+```
+
+## Inputs
+
+| Input | Description | Required | Default |
+|-------|-------------|----------|---------|
+| `title` | Summary title | No | `A.R.C. CI/CD Results` |
+| `status` | Overall status | Yes | - |
+| `results-json` | Path to JSON file | No | `` |
+| `summary-type` | Type of summary | No | `build` |
+| `additional-content` | Extra markdown | No | `` |
+
+## Outputs
+
+| Output | Description |
+|--------|-------------|
+| `summary-path` | Path to generated summary |
+
+## Summary Types
+
+### Build Summary
+
+```json
+{
+  "builds": [
+    {"service": "name", "status": "success", "duration": "45s", "size": "445MB"}
+  ]
+}
+```
+
+### Security Summary
+
+```json
+{
+  "vulnerabilities": {
+    "CRITICAL": 0,
+    "HIGH": 2,
+    "MEDIUM": 5
+  }
+}
+```
+
+### Validation Summary
+
+```json
+{
+  "checks": [
+    {"name": "Dockerfile lint", "passed": true, "details": "7 files checked"},
+    {"name": "Structure check", "passed": false, "details": "SERVICE.MD outdated"}
+  ]
+}
+```
+
+### Deployment Summary
+
+```json
+{
+  "deployments": [
+    {"service": "api", "env": "staging", "status": "success", "url": "https://staging.example.com"}
+  ]
+}
+```
+
+## Status Indicators
+
+| Status | Emoji |
+|--------|-------|
+| `success` | ✅ |
+| `failure` | ❌ |
+| `warning` | ⚠️ |
+| (other) | 🔄 |
+
+## Example Output
+
+```markdown
+## ✅ A.R.C. CI/CD Results
+
+**Run:** [12345678](https://github.com/org/repo/actions/runs/12345678)
+**Commit:** [`abc1234`](https://github.com/org/repo/commit/abc1234...)
+**Triggered by:** developer
+
+### Results
+
+| Service | Status | Duration | Size |
+|---------|--------|----------|------|
+| arc-sherlock-brain | ✅ | 45s | 445MB |
+| arc-scarlett-voice | ✅ | 38s | 412MB |
+
+---
+_Generated by A.R.C. CI/CD_
+```