Phase 3: overhaul CI pipeline

Replace the minimal workflow with parallel jobs:
- lint: ruff check + ruff format --check
- test: Python 3.10/3.11/3.12 matrix, pytest + coverage gate (--cov-fail-under=70,
current 77%), Codecov upload (non-blocking)
- typecheck: mypy (informational/continue-on-error)
- security: bandit (-ll, blocking) + pip-audit (informational)
- frontend: npm ci, tsc --noEmit, build
- docker: build image + smoke /health, /docs, /dashboard/
- inference-smoke: baseline-fallback run with no provider key

Add pytest-cov to requirements. Restrict alert webhooks to http(s) schemes
(fixes bandit B310) so the security job passes.

.github/workflows/ci.yml

@@ -4,60 +4,121 @@ on:
   push:
     branches: [main, master]
   pull_request:
-    branches: [main, master]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install ruff
+      - name: ruff lint
+        run: ruff check .
+      - name: ruff format check
+        run: ruff format --check .
+
   test:
     runs-on: ubuntu-latest
-    
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12']
     steps:
-    - uses: actions/checkout@v4
-    
-    - name: Set up Python
-      uses: actions/setup-python@v5
-      with:
-        python-version: '3.12'
-    
-    - name: Cache pip packages
-      uses: actions/cache@v4
-      with:
-        path: ~/.cache/pip
-        key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt', 'pyproject.toml') }}
-        restore-keys: |
-          ${{ runner.os }}-pip-
-    
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-    
-    - name: Verify dependency lock
-      run: |
-        pip freeze > requirements.lock
-        diff -q requirements.txt requirements.lock || echo "WARNING: requirements.txt and lock mismatch"
-        cat requirements.lock
-    
-    - name: Run tests
-      run: python -m pytest -q --tb=short
-    
-    - name: Run smoke test inference
-      env:
-        OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY || 'sk-test-dummy' }}
-      run: |
-        python -c "import os; os.environ.setdefault('OPENAI_API_KEY', 'sk-test-dummy'); os.environ.setdefault('API_BASE_URL', 'https://api.openai.com/v1'); os.environ.setdefault('MODEL_NAME', 'gpt-4o-mini'); from inference import run_inference; result = run_inference('easy_classification', 'openenv', 'gpt-4o-mini', seed=42); print(f'Smoke test passed: score={result.get(\"score\", 0):.2f}')"
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: pip install -r requirements.txt
+      - name: pytest + coverage gate
+        run: >-
+          python -m pytest -q
+          --cov=env --cov=baseline --cov=benchmark --cov=reports --cov=telemetry --cov=server
+          --cov-report=xml --cov-report=term-missing --cov-fail-under=70
+      - name: Upload coverage to Codecov
+        if: matrix.python-version == '3.12'
+        uses: codecov/codecov-action@v4
+        with:
+          files: coverage.xml
+        continue-on-error: true  # don't fail CI when no token is configured
+
+  typecheck:
+    runs-on: ubuntu-latest
+    continue-on-error: true  # informational until the codebase is fully typed
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install mypy
+      - run: mypy env --ignore-missing-imports --no-strict-optional || true
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: pip install bandit pip-audit
+      - name: bandit (SAST)
+        run: bandit -r env baseline benchmark reports telemetry server -ll
+      - name: pip-audit (dependency vulnerabilities)
+        run: pip-audit -r requirements.txt
+        continue-on-error: true  # advisories may be unfixable upstream; informational
+
+  frontend:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: dashboard
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+      - run: npm ci || npm install
+      - name: TypeScript check
+        run: npx tsc --noEmit
+      - name: Build dashboard
+        run: npm run build
 
   docker:
     runs-on: ubuntu-latest
-    
+    needs: [test, frontend]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build image
+        run: docker build -t exec-email-copilot .
+      - name: Smoke test container
+        run: |
+          docker run -d --name app -p 7860:7860 exec-email-copilot
+          ok=0
+          for _ in $(seq 1 30); do
+            if curl -fsS http://localhost:7860/health > /dev/null; then ok=1; break; fi
+            sleep 2
+          done
+          if [ "$ok" != "1" ]; then docker logs app; exit 1; fi
+          curl -fsS http://localhost:7860/docs > /dev/null
+          curl -fsS http://localhost:7860/dashboard/ > /dev/null
+          docker rm -f app
+
+  inference-smoke:
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    
-    - name: Build Docker image
-      run: docker build -t exec-email-copilot .
-    
-    - name: Test container health
-      run: |
-        docker run -d --name test-container -p 7861:7860 exec-email-copilot
-        sleep 5
-        docker logs test-container
-        docker rm -f test-container
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip install -r requirements.txt
+      - name: Inference (baseline fallback, no provider key)
+        run: python inference.py --task easy_classification --max-steps 20

requirements.txt

@@ -7,6 +7,7 @@ pyyaml
 httpx
 scipy
 pytest
+pytest-cov
 streamlit
 openai
 sqlalchemy

telemetry/alerts.py

@@ -57,6 +57,9 @@ class AlertManager:
         return triggered
 
     def _send_webhook(self, webhook: str, alert: Alert) -> None:
+        # Only POST to http(s) webhooks; reject file:// and other schemes.
+        if not webhook.lower().startswith(("http://", "https://")):
+            return
         try:
             payload = json.dumps(
                 {
@@ -70,7 +73,7 @@ class AlertManager:
                 data=payload,
                 headers={"Content-Type": "application/json"},
             )
-            urllib.request.urlopen(req, timeout=5)
+            urllib.request.urlopen(req, timeout=5)  # nosec B310 - scheme restricted to http(s) above
         except Exception:
             pass