ci: add GitHub Actions workflows

[Copilot]

The repo had no CI/CD workflows despite having branch protection with required status checks enabled. Adds four workflows to cover the full development and release lifecycle.

Workflows

• ci.yml — Lint (ruff), type-check (mypy), and test (pytest) on push/PR to master; test matrix covers Python 3.11 and 3.12
• schema.yml — Validates schema.sql applies cleanly to a fresh SQLite DB on changes to schema or migration files
• release.yml — Builds and publishes to PyPI via OIDC trusted publishing on v*.*.* tags (no stored secrets needed)
• dependency-review.yml — Scans dependency changes for known vulnerabilities on every PR

Required status checks to wire up

After merging, add these to the master branch protection ruleset under required status checks:

Lint (ruff)
Type Check (mypy)
Test (pytest) / Python 3.11
Test (pytest) / Python 3.12

Original prompt

Create four GitHub Actions workflow files in .github/workflows/. All files must be fully written and committed before this PR is marked ready for review.

---

.github/workflows/ci.yml

name: CI

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

jobs:
  lint:
    name: Lint (ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run ruff
        run: ruff check src/

  typecheck:
    name: Type Check (mypy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run mypy
        run: mypy src/

  test:
    name: Test (pytest) / Python ${{ matrix.python-version }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version:
          - "3.11"
          - "3.12"
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install dependencies
        run: pip install -e ".[dev]"
      - name: Run pytest
        run: pytest --tb=short -q

---

.github/workflows/schema.yml

name: Schema

on:
  push:
    paths:
      - "src/mboxer/db/schema.sql"
      - "src/mboxer/db/migrations/**"
      - "schema_ingest_tracking.sql"

jobs:
  validate:
    name: Validate SQLite schema
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Apply schema to a fresh database
        run: |
          sqlite3 /tmp/test.sqlite < src/mboxer/db/schema.sql
          echo "Schema applied cleanly"

---

.github/workflows/release.yml

name: Release

on:
  push:
    tags:
      - "v*.*.*"

jobs:
  build-and-publish:
    name: Build and publish to PyPI
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
      - name: Install build tools
        run: pip install build
      - name: Build
        run: python -m build
      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@release/v1

---

.github/workflows/dependency-review.yml

name: Dependency Review

on:
  pull_request:

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/dependency-review-action@v4

---

Instructions

• Create a new branch named ci/add-workflows
• Commit all four files exactly as specified above in a single commit
• Open a pull request against master with title: ci: add GitHub Actions workflows
• Do NOT mark the PR as draft — it should be ready for review once all files are committed

The following is the prior conversation context from the user's chat exploration (may be truncated):

Assistant: ## uscient/mboxer — High-Level Overview

mboxer is a local-first Python CLI tool that transforms Gmail/Google Takeout MBOX exports into structured, AI-ready knowledge assets — primarily targeting NotebookLM, RAG pipelines, and local LLM workflows.

---

🎯 Core Purpose

Gmail MBOX exports are raw and unwieldy. mboxer bridges that gap by converting them into:

Output	Purpose
Markdown source packs	Organized by category/year for NotebookLM upload
SQLite database	Local, durable index for all messages, threads, classifications
JSONL exports	RAG pipelines, embeddings, local LLM tools
CSV exports (planned)	Spreadsheet review and auditing

---

⚙️ Pipeline Stages

The full workflow is a sequential CLI pipeline:

ingest → normalize → classify → security-scan → scrub → review → export

1. Ingest — Parses .mbox files using Python's mailbox stdlib, with resumable checkpoints and deduplication
2. Classify — Rule-based categorization (sender, domain, subject keywords) at message or thread level; LLM via Ollama is config-wired but not yet fully connected
3. Review — Interactive CLI to approve/reject proposed categories
4. Security scan — Flags sensitive content; configurable redaction of phone numbers, SSNs, credit cards, etc.
5. Export — Outputs Markdown, JSONL, and manifests; five NotebookLM limit profiles (standard → ultra_safe)

---

🗂️ Source Layout

src/mboxer/
  cli.py            # argparse CLI entry point
  ingest.py         # MBOX ingest pipeline
  no...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>