The container-mode runner has no Docker socket, so the gitleaks 'docker run'
step failed; download and run the binary instead. Scope npm audit to production
dependencies (--omit=dev) so dev-toolchain advisories don't block merges, and
match dotnet's own vulnerable-packages line to avoid severity-word false hits.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
security.yml: gitleaks secret scan + NuGet/npm vulnerability gate on PRs and
pushes to main/develop (detective backstop to the pre-commit hook).
deploy-staging.yml: on merge to develop, re-verify then rebuild the isolated
local staging stack (needs a self-hosted Windows runner).
deploy-prod.yml: tag-gated production promotion (the tag is the approval), ready
to activate once the Linux server + its runner exist.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Real CI at .gitea/workflows/ci.yml (Gitea reads .gitea/workflows, not the empty
untracked .git/workflows/ci.yml cruft): backend dotnet build + dotnet test (39 tests)
and frontend npm ci + build, on pushes to main/develop and all PRs. Establishes the
merge gate recommended in the Phase 7 git-workflow review.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cesnimda