ci: add GitHub Actions workflows

[Copilot]

Recreates the four CI/CD workflows from PR #3 onto current master (which already carries the mypy fixes), and removes the ruff violations that would immediately break the new lint job.

Workflows added

• ci.yml — ruff lint, mypy type-check, pytest on push/PR to master; test matrix covers Python 3.11 and 3.12; all jobs scoped to permissions: contents: read
• schema.yml — applies schema.sql to a fresh SQLite DB on changes to schema or migration files; permissions: contents: read
• release.yml — builds and publishes to PyPI via OIDC trusted publishing on v*.*.* tags (no stored secrets)
• dependency-review.yml — scans dependency diffs for known vulnerabilities on every PR

Source fixes (required for lint job to pass)

• cli.py: unused list_accounts in local import
• ingest.py: unused create_account, parse_gmail_labels; bare f-string
• db/schema.py: unused is_fresh variable
• security/policy.py: unused from typing import Any

Original prompt

Create a new pull request against master in uscient/mboxer that recreates the GitHub Actions workflow changes from PR #3 onto the current master branch.

Context:

• PR ci: add GitHub Actions workflows #6 (https://github.com/uscient/mboxer/pull/6) was created but stalled after the initial planning commit and contains no file changes.
• PR ci: add GitHub Actions workflows #3 (https://github.com/uscient/mboxer/pull/3) contains the workflow implementation that should be recreated.
• Current master already includes newer fixes, so do not revive the old PR branch; start fresh from current master.

Task:

1. Compare PR ci: add GitHub Actions workflows #3 against current master.
2. Create a new branch from master.
3. Recreate these workflow files from PR ci: add GitHub Actions workflows #3, preserving behavior unless minimal updates are required for current master:
   • .github/workflows/ci.yml
   • .github/workflows/schema.yml
   • .github/workflows/release.yml
   • .github/workflows/dependency-review.yml
4. Also bring over any small source-code cleanup changes from PR ci: add GitHub Actions workflows #3 that are still needed for CI/lint/type-checks to pass on current master.
5. Validate the workflows and ensure the branch contains actual committed file changes before opening the PR.
6. Open a new pull request targeting master.

Important constraints:

• Do not modify or reuse PR ci: add GitHub Actions workflows #6.
• Do not modify or revive the old PR ci: add GitHub Actions workflows #3 branch.
• Base everything on the latest master.
• Keep changes minimal and focused on reproducing the workflow intent from PR ci: add GitHub Actions workflows #3.
• Do not open the PR until the workflow files are committed and visible in the diff.
• Use a concise non-draft PR title.

Expected workflow intent:

• CI workflow for ruff, mypy, and pytest
• Schema validation workflow for SQLite schema changes
• PyPI release workflow using OIDC trusted publishing
• Dependency review workflow on pull requests

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: @uscient/mboxer/pull/6

Assistant: PR #6 is not ready for review yet — it’s still an empty draft placeholder.

PR summary

• Title: [WIP] Add GitHub Actions workflows based on PR #3
• State: Open, Draft
• Mergeability: Technically mergeable, but effectively blocked
• CI: No useful CI signal yet
• Commits: 1
• Files changed: 0
• Risk: High, because there is no implementation yet

What this PR currently does

Right now, the branch only contains an “Initial plan” commit and no file changes. That means it has not yet brought over any of the workflow files it was supposed to recreate from PR #3:

• .github/workflows/ci.yml
• .github/workflows/schema.yml
• .github/workflows/release.yml
• .github/workflows/dependency-review.yml

Why it’s blocked

Two practical blockers:

1. It is still a draft
2. There are zero changed files, so the actual task described in the PR body has not been completed

Review assessment

I would not approve this PR in its current state.

There’s nothing substantive to review yet:

• no workflow files added
• no CI config to inspect
• no adaptations to current master
• no validation evidence

Merge readiness and risk

Assessment: Not ready to merge.

Critical items before merge:

• Add the workflow files from the original PR intent
• Make any minimal updates needed for current master
• Ensure the workflows pass validation / CI
• Mark the PR ready for review once implementation exists

One notable inconsistency

You also shared commit ce02a3569ec2c971e24520b0c5737acb15d41dda with message:

fix: resolve mypy type-check errors blocking CI for PR #3

That suggests related work exists elsewhere, but that commit is not reflected as changes in PR #6 based on the PR metadata I could retrieve.

Want me to

1. Compare PR ci: add GitHub Actions workflows #6 against PR ci: add GitHub Actions workflows #3 and tell you exactly what workflow files are missing.
2. Review PR ci: add GitHub Actions workflows #3 itself and summarize the workflows that should be recreated.
3. Check whether the Copilot session stalled and identify what likely went wrong.
4. Re-review PR ci: add GitHub Actions workflows #6 once files are actually pushed.

User: 3

Assistant: Yes — it looks like the Copilot coding session stalled before making any code changes.

Why I think that

From the PR metadata we already have for PR #6:

• the PR is still Draft
• it has 1 commit
• that commit is just “Initial plan”
• it shows 0 files changed
• the task checklist in the PR body is still almost entirely unchecked

That pattern usually means the agent successfully:

• created the branch
• opened the PR
• wrote the task plan

…but then never completed the implementation phase.

Most likely failure mode

The most likely explanation is:

The agent stopped after planning and never pushed the workflow files.

Given the PR goal, it should have added:

• .github/workflows/ci.yml
• .github/workflows/schema.yml
• .github/workflows/release.yml
• .github/workflows/dependency-review.yml

Since none of those appear in PR #6, the session likely failed during one of th...

This pull request was created from Copilot chat.