ci: consolidate repository workflow backstops

.github/workflows/build-baseline.yml

@@ -12,6 +12,12 @@ on:
     tags:
       - "v*"
 
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.repository }}-${{
+    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 
@@ -288,9 +294,11 @@ jobs:
       - name: Explain non-blocking macOS amd64 artifact upload failure
         if: ${{ steps.upload-macos-amd64.outcome == 'failure' }}
         run: |
-          echo "Artifact upload failed after the macOS amd64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
-          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
-          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo "Artifact upload failed after the macOS amd64 bundle was packaged."
+            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
+            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
+          } >> "$GITHUB_STEP_SUMMARY"
 
   build-macos-arm64:
     name: build / macos / arm64
@@ -350,9 +358,11 @@ jobs:
       - name: Explain non-blocking macOS arm64 artifact upload failure
         if: ${{ steps.upload-macos-arm64.outcome == 'failure' }}
         run: |
-          echo "Artifact upload failed after the macOS arm64 bundle was packaged." >> "$GITHUB_STEP_SUMMARY"
-          echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence." >> "$GITHUB_STEP_SUMMARY"
-          echo "Tag and release builds remain blocking because release publication requires uploaded artifacts." >> "$GITHUB_STEP_SUMMARY"
+          {
+            echo "Artifact upload failed after the macOS arm64 bundle was packaged."
+            echo "Pull request builds keep artifact upload non-blocking because GitHub artifact service or DNS failures do not invalidate the build evidence."
+            echo "Tag and release builds remain blocking because release publication requires uploaded artifacts."
+          } >> "$GITHUB_STEP_SUMMARY"
 
   gate-macos:
     name: gate / build / macos

.github/workflows/ci.yml

@@ -10,6 +10,12 @@ on:
       - develop
       - main
 
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.repository }}-${{
+    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/ossf-scorecard.yml

@@ -9,6 +9,10 @@ on:
       - develop
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions: read-all
 
 jobs:

.github/workflows/release.yml

@@ -1,10 +1,6 @@
 name: release
 
 on:
-  pull_request:
-    branches:
-      - develop
-      - main
   push:
     branches:
       - develop
@@ -13,6 +9,10 @@ on:
       - "v*"
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 

.github/workflows/sbom.yml

@@ -15,6 +15,12 @@ on:
     types:
       - published
 
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.repository }}-${{
+    github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 permissions:
   contents: read
 

.github/workflows/security-audit.yml

@@ -1,14 +1,15 @@
-name: security-audit
+name: security-backstop
 
 on:
-  pull_request:
-    branches:
-      - develop
-      - main
   push:
     branches:
       - develop
       - main
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -19,9 +20,12 @@ env:
   GIT_CONFIG_VALUE_0: develop
 
 jobs:
-  audit:
-    name: security-audit
+  security-backstop:
+    name: security-backstop
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -49,10 +53,45 @@ jobs:
         run: uv sync --project services/analysis-engine --group dev --frozen
       - name: Audit Python dependencies
         run: uv run --project services/analysis-engine --with pip-audit==2.8.0 pip-audit --local --strict
+      - name: Run Bandit
+        working-directory: services/analysis-engine
+        run: uv run bandit -c pyproject.toml -r src
       - name: Install stable Rust toolchain
         run: rustup toolchain install stable --profile minimal
       - name: Install cargo-audit
         run: cargo +stable install cargo-audit --locked
       - name: Audit Rust dependencies
         working-directory: apps/desktop/src-tauri
         run: cargo +stable audit
+      - name: Scan for common hardcoded secrets
+        run: |
+          ! git grep -nE '(g[h]p_|g[h]o_|A[K]IA[0-9A-Z]{16}|A[I]za[0-9A-Za-z\-_]{35}|BEGIN (R[S]A|E[C]|OPENS[S]H|P[G]P) PRIVATE KEY)' -- . ':(exclude)package-lock.json' ':(exclude)node_modules/**'
+      - name: Run Trivy filesystem scan summary
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: table
+          severity: CRITICAL,HIGH,MEDIUM
+          exit-code: "0"
+          skip-dirs: services/analysis-engine/.venv
+          trivyignores: ./.trivyignore
+      - name: Run Trivy filesystem scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          version: v0.71.2
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH,MEDIUM
+          limit-severities-for-sarif: true
+          exit-code: "1"
+          skip-dirs: services/analysis-engine/.venv
+          trivyignores: ./.trivyignore
+      - name: Upload Trivy scan results to GitHub Security tab
+        if: always()
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
+        with:
+          sarif_file: trivy-results.sarif

CHANGELOG.md

@@ -10,6 +10,7 @@
 
 ### Changed
 
+- Consolidated Bandit, dependency audits, supplemental secret checks, and Trivy into one trusted-branch security backstop, delegated CodeQL to GitHub default setup, and removed duplicate local PR security and release-preflight runs.
 - Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
 
 ### Fixed
@@ -74,4 +75,4 @@
 
 - `ChordsFeature` (코드 분석) 화면에서 각 파트(Role)의 `transpositionPlan`(이조/조옮김 계획)을 표시하는 기능을 추가했습니다.
 - `RangesFeature` (음역대 분석) 화면에서 겹침 경고(Overlap warning) 외에 해당 파트의 채보(Transcription) 가능 노드 수를 요약하여 보여주는 기능을 추가했습니다.
-- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).
+- 신규 UI 요소에 대한 단위 테스트를 추가했습니다 (`apps/desktop/src/features/chords/index.test.tsx`, `apps/desktop/src/features/ranges/index.test.tsx`).

docs/architecture/overview.md

@@ -41,6 +41,6 @@ GitHub is the source of truth for repository governance, PR review, CI/CD, Code
 
 ## CI/CD and release flow
 
-- PRs into `develop` and `main` run CI, dependency review, security audit, secret-scan gate, SBOM generation, and CodeQL
+- PRs into `develop` and `main` run repository CI, SBOM, and platform builds alongside organization-required OSV, dependency-review, Trivy, CodeQL/code-quality, Semgrep SAST, Strix, and Noema evidence; consolidated local security backstops run after trusted-branch pushes
 - release flows publish desktop artifacts plus SBOM evidence to GitHub Releases through a tag-driven draft-before-publish path
 - branch protection connects stable required checks after bootstrap workflows exist

docs/repository/bootstrap-plan.md

@@ -31,12 +31,13 @@ After workflows exist, require these stable checks on `main` and `develop`:
 - `CodeRabbit`
 - `ci / build-and-test`
 - `dependency-review`
-- `security-audit`
-- `CodeQL`
 - `sbom`
-- `release-preflight`
 - `gate / build / windows`
 - `gate / build / macos`
+- `trivy-fs`
+- `Analyze (javascript-typescript)`
+- `Analyze (python)`
+- organization-required Security Scan, CodeQL/code-quality, SAST Semgrep, Strix, Noema, OpenCode, scheduler, and empty-PR workflows
 
 ## Initial README exception