Add secret scanning, Dockerfile lint, ruff lint/format gate, coverage gate, and automatic CVE remediation PRs

- gitleaks (via docker cp, dockerignore-agnostic) and hadolint scan every push/PR
- new ruff lint stage (ruff.toml pins known-first-party for host/container
  consistency; F841/B007 in webui.py left un-fixed via per-file-ignores —
  app-logic changes, flagged for review rather than auto-fixed)
- pytest --cov-fail-under=90 gate on the test stage (already had pytest-cov,
  never wired into CI until now)
- scheduled Trivy critical failures now attempt an apk upgrade rebuild and open a PR
  if it clears the finding, instead of just failing red
- ruff --fix/--format applied to existing code to start the gate clean

.gitea/workflows/ci.yml

@@ -18,6 +18,21 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Scan for secrets
+        run: |
+          # docker cp, not a build COPY: a repo's own .dockerignore (e.g. one that
+          # excludes .git for prod builds) would otherwise silently give an empty,
+          # falsely-clean scan.
+          CID=$(docker create zricethezav/gitleaks:v8.30.1 detect --source=/repo --no-banner -v)
+          docker cp . "$CID:/repo"
+          docker start -a "$CID"
+          STATUS=$?
+          docker rm "$CID" > /dev/null
+          exit $STATUS
+
+      - name: Lint Dockerfile with hadolint
+        run: docker run --rm -i hadolint/hadolint:v2.15.1-alpine hadolint --failure-threshold error - < Dockerfile
+
       - name: Build Docker image
         run: |
           docker build -t lumeex:ci . 2>&1 | tee build.log
@@ -46,7 +61,10 @@ jobs:
       - name: Run unit tests
         run: |
           docker build --target test -t lumeex:test .
-          docker run --rm lumeex:test pytest -v
+          docker run --rm lumeex:test pytest -v --cov=. --cov-report=term-missing --cov-fail-under=90
+
+      - name: Lint with ruff
+        run: docker build --target lint -t lumeex:lint .
 
       - name: Check deprecation warnings
         run: |
@@ -56,12 +74,53 @@ jobs:
           fi
 
       - name: Scan with Trivy (critical - blocking)
+        id: trivy_critical
+        continue-on-error: true
         run: |
           docker run --rm \
             -e DOCKER_HOST=tcp://dockerhost:2375 \
             --add-host=dockerhost:host-gateway \
             aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL lumeex:ci
 
+      - name: Handle CRITICAL findings
+        if: steps.trivy_critical.outcome == 'failure'
+        run: |
+          if [ "${{ github.event_name }}" != "schedule" ]; then
+            echo "::error::CRITICAL vulnerabilities found, failing the build."
+            exit 1
+          fi
+
+          echo "Scheduled scan found CRITICAL vulnerabilities — attempting an automatic apk upgrade + rescan."
+
+          sed -i '/^FROM .* AS base$/a RUN apk upgrade --no-cache' Dockerfile
+          docker build -t lumeex:remediated .
+
+          if docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL lumeex:remediated; then
+            echo "apk upgrade clears the CRITICAL finding(s) — opening a PR for review."
+
+            BRANCH="auto/cve-fix-$(date +%Y%m%d)-$(echo "${{ github.sha }}" | cut -c1-7)"
+            git config user.name "lumeex-ci"
+            git config user.email "[email protected]"
+            git checkout -b "$BRANCH"
+            git add Dockerfile
+            git commit -m "Auto-remediate CRITICAL CVE via apk upgrade"
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/lumeex.git" "HEAD:$BRANCH"
+
+            PR_JSON=$(curl -s -X POST \
+              -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
+              -H "Content-Type: application/json" \
+              -d "$(jq -n --arg head "$BRANCH" '{title: "🔒 Auto: remediate CRITICAL CVE via apk upgrade", head: $head, base: "main", body: "Opened automatically by the scheduled CVE scan. An `apk upgrade --no-cache` cleared the CRITICAL Trivy finding(s) in a rebuild — review the diff and merge to publish the fix."}')" \
+              "https://git.djeex.fr/api/v1/repos/Djeex/lumeex/pulls")
+            echo "PR API response: $(echo "$PR_JSON" | jq -r '.html_url // .message // "unknown"')"
+          else
+            echo "::error::apk upgrade does not clear the CRITICAL finding(s) — no automatic fix available, needs manual review."
+            exit 1
+          fi
+
       - name: Scan with Trivy (high - informative)
         run: |
           docker run --rm \