⚡ Bolt: 파이썬 리스트 기반 O(N^2) 룩업을 O(1) 해시맵(Dict)으로 성능 개선

.github/workflows/bandit.yml

@@ -0,0 +1,35 @@
+name: bandit
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+  pull_request:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  bandit-scan:
+    name: Bandit Security Scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          version: "0.8.6"
+          enable-cache: false
+      - name: Sync Python dependencies
+        run: uv sync --project services/analysis-engine --group dev --frozen
+      - name: Run Bandit
+        working-directory: services/analysis-engine
+        run: uv run bandit -c pyproject.toml -r src

.github/workflows/build-baseline.yml

@@ -12,12 +12,6 @@ on:
     tags:
       - "v*"
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 
@@ -294,11 +288,9 @@ jobs:
       - name: Explain non-blocking macOS amd64 artifact upload failure
         if: ${{ steps.upload-macos-amd64.outcome == 'failure' }}
         run: |
-          {
-            echo "Artifact upload failed after the macOS amd64 bundle was packaged."
-            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
-            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Artifact upload failed after the macOS amd64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
+          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
+          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
 
   build-macos-arm64:
     name: build / macos / arm64
@@ -358,11 +350,9 @@ jobs:
       - name: Explain non-blocking macOS arm64 artifact upload failure
         if: ${{ steps.upload-macos-arm64.outcome == 'failure' }}
         run: |
-          {
-            echo "Artifact upload failed after the macOS arm64 bundle was packaged."
-            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
-            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
-          } >> "$GITHUB_STEP_SUMMARY"
+          echo "Artifact upload failed after the macOS arm64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
+          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
+          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
 
   gate-macos:
     name: gate / build / macos

.github/workflows/ci.yml

@@ -10,12 +10,6 @@ on:
       - develop
       - main
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 

.github/workflows/codeql.yml

@@ -0,0 +1,39 @@
+name: codeql
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  analyze:
+    name: codeql
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - javascript-typescript
+          - python
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

.github/workflows/ossf-scorecard.yml

@@ -9,10 +9,6 @@ on:
       - develop
       - main
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions: read-all
 
 jobs:

.github/workflows/release.yml

@@ -1,6 +1,10 @@
 name: release
 
 on:
+  pull_request:
+    branches:
+      - develop
+      - main
   push:
     branches:
       - develop
@@ -9,10 +13,6 @@ on:
       - "v*"
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions:
   contents: read
 

.github/workflows/sbom.yml

@@ -15,12 +15,6 @@ on:
     types:
       - published
 
-concurrency:
-  group: >-
-    ${{ github.workflow }}-${{ github.repository }}-${{
-    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 permissions:
   contents: read
 

.github/workflows/secret-scan-gate.yml

@@ -0,0 +1,29 @@
+name: secret-scan-gate
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+  push:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  secret-scan:
+    name: secret-scan-gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Scan for common hardcoded secrets
+        run: |
+          ! git grep -nE '(g[h]p_|g[h]o_|A[K]IA[0-9A-Z]{16}|A[I]za[0-9A-Za-z\-_]{35}|BEGIN (R[S]A|E[C]|OPENS[S]H|P[G]P) PRIVATE KEY)' -- . ':(exclude)package-lock.json' ':(exclude)node_modules/**'

.github/workflows/security-audit.yml

@@ -1,15 +1,14 @@
-name: security-backstop
+name: security-audit
 
 on:
+  pull_request:
+    branches:
+      - develop
+      - main
   push:
     branches:
       - develop
       - main
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
-  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -20,12 +19,9 @@ env:
   GIT_CONFIG_VALUE_0: develop
 
 jobs:
-  security-backstop:
-    name: security-backstop
+  audit:
+    name: security-audit
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -53,45 +49,10 @@ jobs:
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Audit Python dependencies
         run: uv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict
-      - name: Run Bandit
-        working-directory: services/analysis-engine
-        run: uv run bandit -c pyproject.toml -r src
       - name: Install stable Rust toolchain
         run: rustup toolchain install stable --profile minimal
       - name: Install cargo-audit
         run: cargo +stable install cargo-audit --locked
       - name: Audit Rust dependencies
         working-directory: apps/desktop/src-tauri
         run: cargo +stable audit
-      - name: Scan for common hardcoded secrets
-        run: |
-          ! git grep -nE '(g[h]p_|g[h]o_|A[K]IA[0-9A-Z]{16}|A[I]za[0-9A-Za-z\-_]{35}|BEGIN (R[S]A|E[C]|OPENS[S]H|P[G]P) PRIVATE KEY)' -- . ':(exclude)package-lock.json' ':(exclude)node_modules/**'
-      - name: Run Trivy filesystem scan summary
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scan-ref: .
-          version: v0.71.2
-          format: table
-          severity: CRITICAL,HIGH,MEDIUM
-          exit-code: "0"
-          skip-dirs: services/analysis-engine/.venv
-          trivyignores: ./.trivyignore
-      - name: Run Trivy filesystem scan
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        with:
-          scan-type: fs
-          scan-ref: .
-          version: v0.71.2
-          format: sarif
-          output: trivy-results.sarif
-          severity: CRITICAL,HIGH,MEDIUM
-          limit-severities-for-sarif: true
-          exit-code: "1"
-          skip-dirs: services/analysis-engine/.venv
-          trivyignores: ./.trivyignore
-      - name: Upload Trivy scan results to GitHub Security tab
-        if: always()
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
-        with:
-          sarif_file: trivy-results.sarif

.github/workflows/trivy.yml

@@ -0,0 +1,54 @@
+name: trivy
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+
+permissions:
+  contents: read
+
+env:
+  GIT_CONFIG_COUNT: "1"
+  GIT_CONFIG_KEY_0: init.defaultBranch
+  GIT_CONFIG_VALUE_0: develop
+
+jobs:
+  trivy-fs-scan:
+    name: trivy-fs-scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Run Trivy filesystem scan summary
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0; SHA pinning retained as supply-chain attack mitigation, do not replace with tag.
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+          exit-code: '0'
+          skip-dirs: 'services/analysis-engine/.venv'
+          trivyignores: ./.trivyignore
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0; SHA pinning retained as supply-chain attack mitigation, do not replace with tag.
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH,MEDIUM
+          limit-severities-for-sarif: true
+          exit-code: '1'
+          skip-dirs: 'services/analysis-engine/.venv'
+          trivyignores: ./.trivyignore
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 peeled commit; SHA pinning retained as supply-chain attack mitigation.
+        if: always()
+        with:
+          sarif_file: trivy-results.sarif

.jules/bolt.md

@@ -61,3 +61,6 @@
 ## 2026-07-13 - Array.from mapping optimization
 **Learning:** Using `Array.from({ length: N }).map(...)` creates an intermediate array of `undefined` values which requires memory allocation and garbage collection, adding O(N) unnecessary overhead in frequently re-rendered UI components.
 **Action:** Use `Array.from({ length: N }, (_, index) => ...)` to map elements directly during array creation, avoiding intermediate allocations.
+## 2026-03-06 - [파이썬 O(N^2) 리스트 룩업을 O(1) 딕셔너리로 최적화]
+**Learning:** `chart.py`의 텍스트 변환 로직에서 `not in list`로 중복을 방지하며 삽입하는 방식은 리스트 크기가 커질 때 O(N^2) 병목을 유발합니다. 파이썬 3.7+부터 딕셔너리가 삽입 순서를 유지하므로, `dict[item] = None`을 사용해 순서를 보존하면서 O(1)의 성능 최적화가 가능함을 배웠습니다.
+**Action:** 앞으로 리스트의 중복을 제거하면서 순서를 유지해야 하는 로직에서는 `set` 대신 딕셔너리(dictionary) 키를 활용할 것입니다.

CHANGELOG.md

@@ -10,7 +10,7 @@
 
 ### Changed
 
-- Consolidated Bandit, dependency audits, supplemental secret checks, and Trivy into one trusted-branch security backstop, delegated CodeQL to GitHub default setup, and removed duplicate local PR security and release-preflight runs.
+- Changed chart-export role, cue, and priority de-duplication to insertion-ordered dictionaries, preserving first-occurrence output while replacing repeated linear membership scans with average constant-time key lookups.
 - Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
 
 ### Fixed
@@ -75,4 +75,4 @@
 
 - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다.
 - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다.
-- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).
+- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).

docs/architecture/overview.md

@@ -41,6 +41,6 @@ GitHub is the source of truth for repository governance, PR review, CI/CD, Code
 
 ## CI/CD and release flow
 
-- PRs into `develop` and `main` run repository CI, SBOM, and platform builds alongside organization-required OSV, dependency-review, Trivy, CodeQL/code-quality, Semgrep SAST, Strix, and Noema evidence; consolidated local security backstops run after trusted-branch pushes
+- PRs into `develop` and `main` run CI, dependency review, security audit, secret-scan gate, SBOM generation, and CodeQL
 - release flows publish desktop artifacts plus SBOM evidence to GitHub Releases through a tag-driven draft-before-publish path
 - branch protection connects stable required checks after bootstrap workflows exist