chore(ci): pilot python-app-ci gold-standard reusable

[CybotTM]

What

Pilot the new python-app-ci.yml gold-standard meta-reusable from netresearch/.github on this repo.

One app-ci call now composes:

• python-ci — lint (flake8) + type-check (mypy, non-blocking) + tests (pytest + coverage)
• python-build — python -m build + twine check
• python-audit — pip-audit + bandit + CycloneDX SBOM
• gitleaks — secret scanning
• dependency-review — on PRs

This replaces the former separate lint / test / build reusable-call jobs in ci.yml and the audit job in security.yml (deleted). Bespoke jobs shell-tests, docs, integration-e2e are kept unchanged as siblings.

Reference pinning

The meta is pinned to netresearch/.github@feat/python-gold-standard (not yet on main). Flip to @main after netresearch/.github#252 merges.

Input mapping (repo commands → meta inputs)

Meta input	Value
package-manager	pip
python-versions	["3.14"]
os-versions	ubuntu + macos + windows (preserves the prior cross-OS test matrix)
install-cmd	pip install -r requirements-dev.txt
lint-cmd	the repo's existing flake8 command
type-check-cmd	mypy cli_audit --ignore-missing-imports || true (kept non-blocking)
test-cmd	the repo's existing unit + integration pytest command
enable-build	true (python -m build / twine check dist/*)
run-bandit	true (matches prior default)
enable-gitleaks	true (org GITLEAKS_LICENSE available)
enable-codeql	false — repo uses CodeQL default setup (actions + python); enabling the advanced workflow would conflict

Pilot findings / notes for reviewers

1. Coverage upload gate mismatch (meta gap). The meta does not expose coverage-os / coverage-python-version; the underlying python-ci.yml defaults coverage-python-version to 3.13. This repo is 3.14-only, so the Codecov upload gate never matches and coverage will not upload despite coverage-upload: true. Recommend the meta forward those two inputs (or default the coverage cell to the first matrix entry).
2. Dropped weekly schedule. The deleted security.yml ran the audit on a weekly cron (0 6 * * 1) in addition to push/PR. The meta/ci.yml runs on push/PR only. If the weekly scheduled audit should be preserved, add a schedule: trigger to ci.yml or keep a slimmed schedule-only security.yml.
3. Combining lint/type/test into one matrixed ci job means flake8 + mypy now also run on macOS/windows cells (previously ubuntu-only); tests already ran on all three.

Do not merge

Pilot only. No branch-protection changes (repo has no required status checks configured).

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

• .github/workflows/security.yml

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud