ci: repo hardening (2/3) — CI workflows (shellcheck, prose-lint, CodeQL, gitleaks, Scorecard)#11

Open

ArangoGutierrez wants to merge 17 commits into

cvander:mainfrom

ArangoGutierrez:feat/7-ci-workflows

Commits on Apr 23, 2026

ci: document workflow conventions
ArangoGutierrez
committed
fix(shell): remove dead pattern __* in case statements
ArangoGutierrez
committed
ci: add shellcheck workflow for repo shell scripts
ArangoGutierrez
committed
ci: add markdownlint config
ArangoGutierrez
committed
ci: add .lycheeignore for localhost and template placeholders
ArangoGutierrez
committed
ci: add prose-lint workflow (yamllint, markdownlint, lychee)
ArangoGutierrez
committed
ci: tune markdownlint (disable MD034, exclude data/music dirs)
ArangoGutierrez
committed
fix(docs): add blank lines around headings/lists, language tags to code fences
ArangoGutierrez
committed
ci: add CodeQL workflow pre-wired for python and javascript-typescript
ArangoGutierrez
committed
ci: add .gitleaks.toml with upstream defaults + generic PII rules
ArangoGutierrez
committed
ci: add gitleaks workflow with optional private-overlay hook
ArangoGutierrez
committed
docs: document GITLEAKS_PRIVATE_CONFIG format in maintainer setup
ArangoGutierrez
committed
ci: add OpenSSF Scorecard workflow
ArangoGutierrez
committed
fix(ci): repin codeql-action and scorecard-action to commit SHAs
ArangoGutierrez
committed
fix(ci): tighten gitleaks test-file allowlist to known subtrees
ArangoGutierrez
committed
ci: widen lint path filters to trigger on config and workflow edits
ArangoGutierrez
committed
ci: write gitleaks private overlay to $RUNNER_TEMP, not workspace
ArangoGutierrez
committed