chore: add CI pipeline, linting, and quality infrastructure

.github/dependabot.yml

@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yaml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0d8abe699bfb85fec6de9f7adb5ae17292296ff # v6
+      - run: uv python install 3.12
+      - run: uv sync --extra dev
+      - run: uv run ruff check src/ tests/
+      - run: uv run ruff format --check src/ tests/
+
+  test:
+    runs-on: ubuntu-latest
+    needs: lint
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: astral-sh/setup-uv@d0d8abe699bfb85fec6de9f7adb5ae17292296ff # v6
+      - run: uv python install 3.12
+      - run: uv sync --extra dev
+      - run: uv run pytest -v --cov=src --cov-report=term-missing --cov-fail-under=60

.gitignore

@@ -15,6 +15,13 @@ venv/
 .coverage
 htmlcov/
 
+# Linting
+.ruff_cache/
+
+# Environment
+.env
+.envrc
+
 # IDEs
 .idea/
 .vscode/

.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.8.6
+    hooks:
+      - id: ruff
+        args: [--fix]
+      - id: ruff-format
+
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.21.2
+    hooks:
+      - id: gitleaks

Dockerfile

@@ -19,23 +19,13 @@ RUN pip install --no-cache-dir -U uv
 # Install AsciiDoc validator (asciidoctor.js)
 RUN npm install -g @asciidoctor/core @asciidoctor/cli
 
-# Install Python dependencies
-RUN pip install --no-cache-dir -U openai mcp mcp-atlassian markdown docutils
-
 # Set up working directory
 WORKDIR /app
 
-# Copy the source files
-COPY src/config.py /app/config.py
-COPY src/github_ops.py /app/github_ops.py
-COPY src/discovery.py /app/discovery.py
-COPY src/generation.py /app/generation.py
-COPY src/comments.py /app/comments.py
-COPY src/suggest_docs.py /app/suggest_docs.py
-COPY src/security_utils.py /app/security_utils.py
-COPY src/doc_index.py /app/doc_index.py
-COPY src/jira_integration.py /app/jira_integration.py
-COPY src/utils.py /app/utils.py
+# Copy project metadata and install Python dependencies from pyproject.toml
+COPY pyproject.toml /app/pyproject.toml
+COPY src/ /app/src/
+RUN pip install --no-cache-dir /app
 
 # Copy entrypoint script
 COPY entrypoint.sh /entrypoint.sh

README.md

@@ -202,6 +202,30 @@ Links that cannot be fetched automatically will be flagged in the review for man
 
 The `[review-feature]` comment includes content from the Jira ticket and linked spec documents (requirements, descriptions, analysis). This comment will be visible to anyone with access to the PR. Ensure that your repository's visibility settings are appropriate for the sensitivity of your Jira and spec doc content.
 
+## Development
+
+Requires Python 3.12+. Uses [uv](https://docs.astral.sh/uv/) for package management.
+
+```bash
+# Install dependencies (including dev tools)
+uv sync --extra dev
+
+# Run tests
+uv run pytest -v
+
+# Run tests with coverage
+uv run pytest --cov=src --cov-report=term-missing
+
+# Lint and format check
+uv run ruff check src/ tests/
+uv run ruff format --check src/ tests/
+
+# Set up pre-commit hooks
+uv run pre-commit install
+```
+
+CI enforces lint, format, and a 60% test coverage threshold on every PR.
+
 ## Performance Optimization
 
 The action builds semantic indexes stored in `.doc-index/`:

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you find a potential security vulnerability in this project, please report it responsibly.
+
+### Use the GitHub Security Tab
+
+This repository is set up to allow vulnerability reports through GitHub's Security Advisories feature. To report a vulnerability:
+
+1. Navigate to the repository's main page.
+2. Select the [**Security**](https://github.com/redhat-community-ai-tools/code-to-docs/security) tab.
+3. Select **Advisories** from the left-hand sidebar.
+4. Click on **Report a vulnerability**.
+5. Fill in the required details and submit the report.
+
+Following this process will create a private advisory for our maintainers to review.
+
+### Do Not Open Public Pull Requests, Issues, or Discussions
+
+Please **do not** discuss the issue, create PRs, or start discussions about the vulnerability. This ensures the vulnerability is not widely exploited before a fix is provided.

entrypoint.sh

@@ -107,7 +107,7 @@ cleanup() {
 trap cleanup EXIT
 
 # Run the documentation enhancer
-if python /app/suggest_docs.py $ARGS; then
+if python /app/src/suggest_docs.py $ARGS; then
   echo "✅ Documentation enhancer completed successfully"
 
   # Set GitHub Actions outputs (if result data is available)

pyproject.toml

@@ -0,0 +1,45 @@
+[project]
+name = "code-to-docs"
+version = "0.0.0"
+description = "GitHub Action that generates documentation suggestions from code changes using LLMs"
+requires-python = ">=3.12"
+license = {text = "MIT"}
+dependencies = [
+    "openai",
+    "mcp",
+    "mcp-atlassian",
+    "markdown",
+    "docutils",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "pytest-cov>=4.0",
+    "ruff>=0.4",
+    "pre-commit>=4.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.ruff]
+target-version = "py312"
+line-length = 100
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "UP", "B"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["E501", "E402"]
+# E501 suppressed for src: 52 existing violations in prompt strings; ruff format still enforces line length for code
+"src/**" = ["E501", "E402"]
+
+[tool.coverage.run]
+source = ["src"]
+
+[tool.coverage.report]
+fail_under = 60
+show_missing = true