[jonahgabriel]

Summary

• Follow-up to PR feat: standardize CI workflows and branch protection [OMN-7648] #7 — adds 3 standard workflows not covered by that PR
• check-handshake.yml: architecture handshake validation via omnibase_core
• release-dry-run.yml: manual workflow to simulate a release build
• security-scan.yml: dependency, secret, and CodeQL security scanning

Test plan

• Verify CI passes on this PR
• Confirm workflows match org standard patterns

Summary by CodeRabbit

• Chores
  • Enhanced security infrastructure with automated daily scanning for dependencies, secrets, and code quality issues within the continuous integration pipeline.

[coderabbitai]

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow file is added to enable automated security scanning. The workflow includes three security jobs: dependency scanning using Python safety, secret scanning using TruffleHog with verified findings only, and CodeQL analysis with Python language focus and security-and-quality query set.

Changes

Cohort / File(s)	Summary
Security Workflow Configuration .github/workflows/security-scan.yml	New workflow with three jobs: dependency-scan (runs safety checks on Python dependencies), secret-scan (scans for verified secrets using TruffleHog in diff mode for pushes), and codeql (runs CodeQL analysis on Python code). All jobs triggered on schedule, manual dispatch, and pushes to main branch.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 A watchful rabbit's work is done,
Three scanners guard when code is spun,
With safety checks and secrets found,
TruffleHog hops all around! 🔍✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding standard CI workflows for public readiness, including a ticket reference.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jonah/public-readiness-missing-workflows

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/security-scan.yml:
- Around line 32-33: The Export requirements step currently runs "uv export
--format requirements-txt --no-hashes --output-file requirements.txt" which
omits dev groups; update the command in the "Export requirements" job step to
include the --all-groups flag (i.e., add --all-groups to the uv export
invocation) so pytest/ruff/mypy and other dev dependencies from pyproject.toml
are included in the exported requirements.txt for the Safety scan.
- Around line 39-44: The workflow step named "Run Safety Check" currently
suppresses failures by appending "|| true" to both "safety check --file
requirements.txt --output json > safety-report.json || true" and "safety check
--file requirements.txt || true", so vulnerabilities won't fail the job; remove
the "|| true" suffix (or replace it with explicit handling that writes the JSON
report then exits non-zero on findings) so the safety commands can fail the
step, and optionally use Safety's policy/ignore mechanism if you need to
temporarily ignore specific findings.
- Around line 61-75: Update the pinned TruffleHog action SHA to the latest patch
release by replacing the current commit reference
586f66d7886cd0b037c7c245d4a6e34ef357ab10 used in the two workflow steps
"TruffleHog Secret Scanning (push diff)" and "TruffleHog Secret Scanning (full
scan)" with the commit/SHA that corresponds to v3.94.2; ensure both uses:
trufflesecurity/trufflehog@<new-sha-or-tag-for-v3.94.2> are updated so the
workflow runs the newer patch version.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 3b44498f-f8ef-4fc6-8223-7e89cb6a86e6

📥 Commits

Reviewing files that changed from the base of the PR and between 29a8cb2 and fd0c695.

📒 Files selected for processing (1)

• .github/workflows/security-scan.yml