chore: more quality checks for repository

[raven-wing]

Summary by CodeRabbit

• Chores
  • Added automated security analysis for Python code.
  • Added automated secret detection scanning for pull requests.
  • Added automated license compliance validation for project dependencies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7753b598-9ba4-41ca-bee9-099d7ab60cbb

📥 Commits

Reviewing files that changed from the base of the PR and between 945c6e1 and 5c85302.

📒 Files selected for processing (1)

• .github/workflows/gitleaks.yml

✅ Files skipped from review due to trivial changes (1)

• .github/workflows/gitleaks.yml

---

📝 Walkthrough

Walkthrough

Added three new GitHub Actions workflows: CodeQL (Python code scanning), Gitleaks (secret detection), and License Check (dependency license validation) targeting pushes, pull requests to main, and scheduled runs as configured per workflow.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflows .github/workflows/codeql.yml, .github/workflows/gitleaks.yml, .github/workflows/license-check.yml	Added three CI security workflows: CodeQL initializes and analyzes Python code with the security-and-quality suite; Gitleaks downloads and runs gitleaks v8.26.0 (verifying checksum) on pull requests to main; License Check runs actions/dependency-review-action on PRs with an allowlist of approved licenses and fails on specified severities.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I sniffed the CI trail anew,
CodeQL, Gitleaks, licenses too.
I hopped through checks both strict and neat,
Guarding code with tiny feet. ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore: more quality checks for repository' accurately describes the main changes—adding three new GitHub Actions workflows (CodeQL, Gitleaks, and License Check) that implement quality and security checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Timed out fetching pipeline failures after 30000ms

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/gitleaks.yml:
- Around line 22-25: The workflow currently downloads and executes the Gitleaks
tarball directly; add integrity verification by also downloading the release
checksum file (gitleaks_8.26.0_checksums.txt), compute the tarball checksum
(e.g., sha256) and compare it against the expected value, and abort the job if
the verification fails before running ./gitleaks detect; update the Run Gitleaks
step to fetch both the tarball and checksum, validate with sha256sum --check (or
equivalent) and only extract/execute the archive when the check passes so the CI
fails on mismatch.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 5337c15c-b0f2-42ee-a4eb-fd28c7f7d778

📥 Commits

Reviewing files that changed from the base of the PR and between 486a94e and 945c6e1.

📒 Files selected for processing (3)

• .github/workflows/codeql.yml
• .github/workflows/gitleaks.yml
• .github/workflows/license-check.yml

[github-actions]

🧪 E2E Test Results

📊 View full workflow run
🔗 Commit: 945c6e1

📊 E2E Stress Test Performance

✅ Status: PASSED (12410.6ms max < 25000ms limit)

Metric	Value
Average Time	10935.08ms
Minimum Time	10219.44ms
Maximum Time	12410.6ms
Completed Runs	5/5
Avg Markers Loaded	71

📈 Individual Run Times

Run	Time (ms)	Markers
Run 1	10623.53ms	71
Run 2	10219.44ms	71
Run 3	11104.79ms	71
Run 4	10317.04ms	71
Run 5	12410.6ms	71

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

🧪 E2E Test Results

📊 View full workflow run
🔗 Commit: 5c85302

📊 E2E Stress Test Performance

✅ Status: PASSED (13045.38ms max < 25000ms limit)

Metric	Value
Average Time	12295.01ms
Minimum Time	11715.32ms
Maximum Time	13045.38ms
Completed Runs	5/5
Avg Markers Loaded	71

📈 Individual Run Times

Run	Time (ms)	Markers
Run 1	11903ms	71
Run 2	11938.73ms	71
Run 3	12872.63ms	71
Run 4	11715.32ms	71
Run 5	13045.38ms	71