[johnjaysonlpz]

Summary

This PR hardens CI configuration and security scanning by centralizing pinned tool versions, adding reusable security workflows, and running scheduled weekly scans. It improves fork-safety and reduces drift between local and CI tooling.

Highlights

• Centralized tool pin loading with strict allowlist + per-key validation
• Reusable security workflows for Trivy (repo + image), govulncheck, pip-audit, and Dependency-Check
• Weekly scheduled security scans (with manual workflow_dispatch trigger)
• Clearer CI docs and repo structure references

What changed

Control plane (Docker / Compose / Observability / CI)

• Added reusable workflows: _trivy_repo.yaml, _trivy_image.yaml, _govulncheck.yaml, _pip_audit.yaml, _dependency_check.yaml
• Wired reusable security workflows into ci.yaml
• Added/updated weekly scheduled workflow in weekly-security.yaml
• Hardened tool pin ingestion via composite action (load-tool-versions) with strict validation
• Updated CI policy protections for CI control files (fork-safe, fail-closed)

Services (Go / Java / Python)

• Java build configuration adjusted in java-springboot/pom.xml (coverage/build gate alignment)

Docs / Tooling

• Updated README CI section + repo structure to include weekly security workflow
• Ensured .ci-local.sh aligns with pinned tooling expectations

Breaking changes / Migration notes

None.

How to test

Local / Integration

# Optional: run local CI gates (from repo root)
./.ci-local.sh doctor all --summary
./.ci-local.sh

# If you want to validate Java build gates specifically:
cd java-springboot
mvn -B -ntp verify

Verify

• GitHub Actions CI runs successfully on a branch push and PR
• Weekly Security workflow exists and can be triggered manually
• Artifacts are uploaded (Trivy reports, govulncheck report, pip-audit JSON, dependency-check reports) when enabled by workflow inputs
• Tool pins are loaded via load-tool-versions and fail fast if invalid/empty

Artifacts

• N/A

Notes

• Fork PRs: SARIF upload is restricted per workflow inputs and repo ownership checks.
• CI tool versions are controlled exclusively via .ci-tool-versions.sh.

References

• N/A

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3772fda004

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55878e858f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".