chore: adopt fallow static analysis CI gate (#15)

[rohithgollapalli]

Closes #15 (CI lane — Steps 1/3/4).

Adopts fallow as resumelint's standing static-analysis tool, wiring up the CI lane only. Step 2 (baseline triage + Stop-hook registration) depends on #36 and is tracked there.

Changes

• package.json — fallow ^2.96.0 added to devDependencies (+ lockfile). npx fallow --version → fallow 2.96.0 (signed).
• .github/workflows/ci.yml — new report-only step fallow audit --format sarif, uploaded to GitHub code scanning via github/codeql-action/upload-sarif@v3. Non-blocking (|| true); a follow-up flips it to a hard gate once the baseline is clean. Added security-events: write to the job so the SARIF upload can publish.

Acceptance criteria

• npx fallow --version works (devDep committed to package.json + lockfile)
• .gitignore contains .fallow/ (already present on main)
• ci.yml produces SARIF and uploads it to code scanning, non-blocking
• No src/ files modified (tooling + CI only)
• npm run build and npm test pass unchanged (351 tests green)
• .fallow/baseline.json + findings summary — depends on Add fallow-stop.sh to repo as tracked hook script (prerequisite for #15) #36 (Step 2)
• Register fallow-stop.sh in .claude/settings.local.json — depends on Add fallow-stop.sh to repo as tracked hook script (prerequisite for #15) #36

Notes

• fallow audit returns 0 results locally — audit is the diff/risk gate, not the full dead-code/dupes inventory (that lands in the Add fallow-stop.sh to repo as tracked hook script (prerequisite for #15) #36 baseline), so the gate is green as intended for report-only.
• Dependency footprint: fallow adds 10 lockfile entries — fallow itself, its one runtime dep detect-libc, and 8 @fallow-cli/* optional per-platform binaries (only the host's installs). All are integrity-pinned. The npm registry lists fallow with a single dependency.
• npm audit: the 5 advisories on this branch (dompurify, esbuild, protobufjs, vite, vitest) are all pre-existing and unrelated to fallow — they trace to posthog-js and the vite/vitest dev stack, are dev-only, and never reach the shipped client bundle. fallow contributes zero advisories.

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[s-annam]

PR Review: chore: adopt fallow static analysis CI gate (#15)

Summary

Clean, well-scoped CI-only adoption of fallow static analysis. Build/lint/typecheck green, 351 tests pass, no src/ files touched. The package is legit and the CI logic is sound. Approving — with one correction to the PR description before merge.

Verified

Check	Result
Build / lint / typecheck	green
Tests	351 passed (32 files)
fallow provenance	real fallow-rs/fallow (3649★, MIT), published via GitHub Actions OIDC trusted publisher; binaries integrity-pinned
Deps added	10 — fallow + detect-libc + 8 @fallow-cli/* optional platform binaries
--base flag	valid (alias of --changed-since)
SARIF step	runs → valid SARIF, distinct automationDetails.id per run (solves CodeQL multi-run/category rejection)
npm ci before npx fallow	yes → uses pinned binary, not a fresh fetch
fetch-depth: 0	correct — needed so checkout exposes origin/main for the merge-base

Key Findings

1. [Suggestion — fix before merge] PR description misattributes dependencies/vulns to fallow. The body states "the fallow dependency tree adds 523 transitive packages; npm audit reports 4 vulnerabilities (1 critical, 2 high, 1 moderate)." Both are inaccurate:

   • fallow adds 10 packages, not 523 (npm registry shows deps: 1 — detect-libc; the rest are optional per-platform binaries).
   • The audit vulns (now 5: dompurify, esbuild, protobufjs, vite, vitest) are all pre-existing and trace to posthog-js and vite/vitest — none originate from fallow:

     dompurify   ← posthog-js
     protobufjs  ← posthog-js → @opentelemetry/otlp-transformer
     esbuild     ← vite@7
     vite/vitest ← dev test stack
     

   The change itself is clean; the description just shouldn't pin the repo's existing vulns on the new tool (on a public repo this misleads anyone reading merge history). Please correct the Notes section before merge.

2. [Nit] Stale test count. AC says "342 tests green"; it's 351 now after the merge from main.

Highlights

• The empty-SARIF fallback + per-run automationDetails.id stamping is a thoughtful touch — keeps the upload step from ever failing on an empty/multi-run file.
• fetch-depth: 0 + explicit --base origin/main + security-events: write scoped to the job: all the right plumbing for a report-only SARIF lane.
• Correctly held Step 2 (baseline + Stop-hook) for #36 rather than over-scoping.

Verdict

Action: APPROVE
Rationale: Zero blocking code issues. Implementation is correct, dependencies are legit and integrity-pinned, and the CI gate is non-blocking as intended. The only ask is a factual correction to the PR description's dependency/vuln claims (and the stale test count) — neither is a code defect.