Approved scope: pyright (typecheck), gitleaks (secret scan), deptry (dependency hygiene), split format:check into its own CI row, bandit (with targeted subprocess suppressions — this codebase is subprocess-by-design), and a release-verify workflow that installs from the live tap (brew install clintmod/formulas/macprefs) on release-published + manual dispatch, with retries for GitHub propagation lag (bit us on the v1.0.27 rollout). Skipped: flake8 (ruff covers pyflakes/pycodestyle), hadolint/docker (no Dockerfile).
Approved scope: pyright (typecheck), gitleaks (secret scan), deptry (dependency hygiene), split format:check into its own CI row, bandit (with targeted subprocess suppressions — this codebase is subprocess-by-design), and a release-verify workflow that installs from the live tap (brew install clintmod/formulas/macprefs) on release-published + manual dispatch, with retries for GitHub propagation lag (bit us on the v1.0.27 rollout). Skipped: flake8 (ruff covers pyflakes/pycodestyle), hadolint/docker (no Dockerfile).