CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing (#17)

- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth

---------

Co-authored-by: Djeex <[email protected]>
Reviewed-on: #17

tests/test_blocklist_scheduler.py

@@ -56,6 +56,7 @@ def test_backup_first_start_raises_if_adguard_yaml_missing(tmp_path, monkeypatch
 
 # --- update_yaml_with_ips (pyyaml) ---
 
+
 def test_update_yaml_with_ips_writes_disallowed_clients(tmp_path, monkeypatch):
     adguard_yaml = tmp_path / "AdGuardHome.yaml"
     adguard_yaml.write_text("dns:\n  bind_hosts:\n  - 0.0.0.0\n")
@@ -101,8 +102,11 @@ def test_update_yaml_with_ips_missing_dns_key_raises(tmp_path, monkeypatch):
 
 # --- fetch_all_country_codes / download_cidr_lists / restart_adguard_container (requests) ---
 
+
 def test_fetch_all_country_codes_parses_codes(monkeypatch):
-    monkeypatch.setattr(bs.requests, "get", lambda *a, **k: FakeResponse(text='COUNTRIES = ["FR", "DE", "US"]\n'))
+    monkeypatch.setattr(
+        bs.requests, "get", lambda *a, **k: FakeResponse(text='COUNTRIES = ["FR", "DE", "US"]\n')
+    )
 
     assert bs.fetch_all_country_codes() == {"fr", "de", "us"}
 
@@ -136,7 +140,9 @@ def test_restart_adguard_container_success_does_not_raise(monkeypatch):
 
 
 def test_restart_adguard_container_error_status_does_not_raise(monkeypatch):
-    monkeypatch.setattr(bs.requests, "post", lambda *a, **k: FakeResponse(status_code=500, text="err"))
+    monkeypatch.setattr(
+        bs.requests, "post", lambda *a, **k: FakeResponse(status_code=500, text="err")
+    )
 
     bs.restart_adguard_container()
 
@@ -152,6 +158,7 @@ def test_restart_adguard_container_network_error_does_not_raise(monkeypatch):
 
 # --- schedule_job (schedule) ---
 
+
 @pytest.fixture(autouse=True)
 def clear_schedule():
     yield