ci: restructure workflows to match org ruleset contract

[Nelson Spence (Fieldnote-Echo)]

Summary

• Split test matrix into test-run + test aggregator
• Split lint into lint (ruff), typecheck (mypy), security (bandit + pip-audit)
• Added quality-gate aggregator
• CodeQL: analyze → codeql, dropped matrix
• Scorecard → thin caller to centralized Project-Navi/.github
• Release → centralized _build-reusable.yml@6c4c2d8f
• Deleted local _build-reusable.yml

Check name contract (Python tier)

test, lint, typecheck, security, codeql, semgrep, quality-gate

Test plan

• Verify all 7 required checks appear with correct names
• Verify test aggregator passes when matrix passes
• Verify quality-gate passes when all required jobs pass

🤖 Generated with Claude Code

[github-actions]

✅ Grippy Review — PASS

Score: 88/100 | Findings: 5

Delta: 5 new

Off-diff findings (3)

🟡 MEDIUM: Aggregator jobs rely on matrix result propagation logic

📁 .github/workflows/tests.yml:87

The new 'test' and 'quality-gate' aggregator jobs check that upstream matrix jobs have passed by reading their result using ${{ needs..result }} and failing if any are not 'success'. This assumes that all outputs are properly surfaced and that no required job can skip or be bypassed due to a workflow misconfiguration or race condition (such as an upstream job being skipped or failing to set a status).

Suggestion: Ensure all upstream jobs (test-run, lint, typecheck, security) configured as dependencies are marked as required in branch protection settings, and double-check that no potential early-exit path (e.g., always() allowing a job to run even if dependencies are skipped entirely) can bypass real test failures.

🔵 LOW: No explicit error messages for which required job failed in quality-gate aggregator

📁 .github/workflows/tests.yml:87

The 'quality-gate' job loops over results of required jobs and fails if any job did not succeed, but the error message only reports which result failed as a variable, not which specific job (by name) was at fault. This could make troubleshooting more difficult, especially as the number of required jobs grows.

Suggestion: Enhance the loop logic in 'quality-gate' to print both the job name and its result-either via a bash associative array or individual checks-to provide more informative error output.

🔵 LOW: Test aggregator job does not produce or propagate artifacts

📁 .github/workflows/tests.yml:12

The 'test' aggregator job only checks the matrix result but does not aggregate test reports, code coverage, or other artifacts. If downstream jobs or branch protections depend on these artifacts, this pattern could create gaps.

Suggestion: If other systems or team processes expect test artifacts (logs, coverage, etc.) to be published at the aggregator job level, update the job to collect and upload them from dependencies.

---

_{Commit: 3f52372}

[Copilot]

Pull request overview

This PR restructures the repository’s GitHub Actions workflows to comply with an org ruleset “required check name” contract, while centralizing some workflows into Project-Navi/.github.

Changes:

• Split the test matrix into a non-required test-run job plus a required test aggregator job, and added a quality-gate aggregator.
• Split quality checks into separate required jobs: lint (ruff), typecheck (mypy), and security (bandit + pip-audit).
• Simplified CodeQL to a single required codeql job and migrated Scorecard/Release to centralized reusable workflows.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/tests.yml	Adds required-check aggregators (test, quality-gate) and splits lint/typecheck/security into distinct jobs.
.github/workflows/codeql.yml	Renames job to codeql and removes the language matrix to stabilize the required check name.
.github/workflows/scorecard.yml	Replaces the local Scorecard implementation with a pinned reusable workflow call.
.github/workflows/release.yml	Switches release build to a pinned reusable workflow call and passes package metadata.
.github/workflows/_build-reusable.yml	Deletes the local reusable build workflow in favor of the centralized version.

[project-navi-bot]

All required CI checks passed. Auto-approved by project-navi-bot.