fix: resolve mypy errors, missing redaction imports, and Supply Chain action version

- db_doctor.py: narrow type-ignore to import-untyped, annotate failures list properly
- preflight.py: guard against None before int() in _parse_compose_port
- routes.py: import _is_secret_field and _contains_private_pem from redaction module
  (fallback code referenced them but they were never imported, causing NameError)
- ci.yaml: pin trivy-action to @0.29.0 (0.30.0 does not exist)
- Reformat emitter.py, db_doctor.py, preflight.py with black

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AhwicpfSvKesuRxBHs9sQ2

Author: claude

.github/workflows/ci.yaml

@@ -223,7 +223,7 @@ jobs:
           path: sbom.spdx.json
 
       - name: Vulnerability scan
-        uses: aquasecurity/trivy-action@0.30.0
+        uses: aquasecurity/trivy-action@0.29.0
         with:
           scan-type: fs
           scan-ref: .

netengine/api/routes.py

@@ -23,7 +23,12 @@
 from netengine.events.queues import PRIMARY_QUEUES, Queue, dlq_for
 from netengine.logging import get_logger
 from netengine.phase_labels import PHASE_LABELS
-from netengine.security.redaction import redact_for_api, redact_for_support_bundle
+from netengine.security.redaction import (
+    _contains_private_pem,
+    _is_secret_field,
+    redact_for_api,
+    redact_for_support_bundle,
+)
 from netengine.spec.loader import SpecLoadError, load_spec
 from netengine.spec.models import SPEC_SCHEMA_VERSION, NetEngineSpec
 

netengine/diagnostic/db_doctor.py

@@ -69,7 +69,7 @@ def _queue_name(row: object) -> str | None:
 
 async def _inspect_database(db_url: str, *, timeout: float) -> list[DoctorCheckResult]:
     try:
-        import asyncpg  # type: ignore[import]
+        import asyncpg  # type: ignore[import-untyped]
     except ImportError:
         return [
             DoctorCheckResult(
@@ -164,9 +164,7 @@ async def _inspect_database(db_url: str, *, timeout: float) -> list[DoctorCheckR
         await conn.close()
 
 
-def check_database(
-    db_url: str | None, *, timeout: float = 3.0
-) -> list[DoctorCheckResult]:
+def check_database(db_url: str | None, *, timeout: float = 3.0) -> list[DoctorCheckResult]:
     """Return actionable doctor checks for Postgres, pgmq, and event queues."""
     checks = [parsed := _parse_db_url(db_url)]
     if not db_url or parsed.status != DoctorStatus.OK:
@@ -201,7 +199,7 @@ def check_pgmq_runtime_state(state_file: Path) -> DoctorCheckResult:
             required=False,
         )
 
-    failures: list[dict] = data.get("event_send_failures") or []
+    failures: list[dict[str, object]] = data.get("event_send_failures") or []
     disabled_drops = [f for f in failures if f.get("queue") == _PGMQ_DISABLED_QUEUE]
     if disabled_drops:
         return DoctorCheckResult(

netengine/diagnostic/preflight.py

@@ -119,6 +119,8 @@ def _parse_compose_port(raw_port: object) -> tuple[int, str] | None:
     if isinstance(raw_port, dict):
         published = raw_port.get("published") or raw_port.get("target")
         proto = str(raw_port.get("protocol") or "tcp").lower()
+        if published is None:
+            return None
         try:
             return int(published), proto
         except (TypeError, ValueError):
@@ -330,9 +332,7 @@ def _can_bind(port: int, proto: str) -> bool:
 
 def _check_port(port: int, proto: str) -> DoctorCheckResult:
     name = f"port:{port}/{proto}"
-    label = next(
-        (p.label for p in KNOWN_LOCAL_PORTS if p.port == port and p.proto == proto), None
-    )
+    label = next((p.label for p in KNOWN_LOCAL_PORTS if p.port == port and p.proto == proto), None)
     detail_suffix = f" ({label})" if label else ""
     try:
         _can_bind(port, proto)
@@ -479,20 +479,20 @@ def _check_docker_conflicts(ctx: DoctorContext) -> list[DoctorCheckResult]:
                 (
                     DoctorStatus.FAIL
                     if kind == "container" and conflicts
-                    else DoctorStatus.WARN
-                    if conflicts
-                    else DoctorStatus.OK
+                    else DoctorStatus.WARN if conflicts else DoctorStatus.OK
                 ),
                 ", ".join(conflicts) if conflicts else "no known name conflicts",
                 (
                     "Stop/remove conflicting containers before startup."
                     if kind == "container" and conflicts
                     else (
-                        "Run `netengine down` or remove stale Docker resources if these "
-                        "belong to an old run."
+                        (
+                            "Run `netengine down` or remove stale Docker resources if these "
+                            "belong to an old run."
+                        )
+                        if conflicts
+                        else None
                     )
-                    if conflicts
-                    else None
                 ),
                 "docker",
                 required=kind == "container",

netengine/events/emitter.py

@@ -9,7 +9,6 @@
 from netengine.events.schema import EventEnvelope
 from netengine.handlers.context import PhaseContext
 
-
 _PGMQ_DISABLED_QUEUE = "<pgmq_disabled>"