CI/CD hardening: lint, secret scan, coverage gate, auto CVE-fix PRs, GHCR + GitHub mirror publishing (#34)

- release changelog: commits rendered as description (link), divider lines dropped
- gitleaks secret scan and hadolint on every push/PR
- ruff lint/format gate (Python repos) with a pytest --cov-fail-under gate
- scheduled CRITICAL Trivy failures attempt an apk upgrade rebuild and open a follow-up PR if it clears the finding, instead of just failing red
- images also published to ghcr.io/djeex/<repo>
- a matching GitHub Release is created on the GitHub mirror, with a notice pointing back to this repo as the source of truth

src/py/builder/css_generator.py

@@ -1,7 +1,7 @@
 import logging
-from pathlib import Path
 from shutil import copyfile
 
+
 def generate_css_variables(colors_dict, output_path):
     """Generate css variables for theme colors"""
     css_lines = [":root {"]
@@ -13,6 +13,7 @@ def generate_css_variables(colors_dict, output_path):
         f.write("\n".join(css_lines))
     logging.info(f"[✓] CSS variables written to {output_path}")
 
+
 def generate_fonts_css(fonts_dir, output_path, fonts_cfg=None):
     """Generate css variables fonts"""
     font_files = list(fonts_dir.glob("*"))
@@ -35,7 +36,7 @@ def generate_fonts_css(fonts_dir, output_path, fonts_cfg=None):
 
     css_lines = []
     for font_name, sources in font_faces.items():
-        css_lines.append(f"@font-face {{")
+        css_lines.append("@font-face {")
         css_lines.append(f"  font-family: '{font_name}';")
         srcs = [f"url('../fonts/{file}') format('{fmt}')" for file, fmt in sorted(sources)]
         css_lines.append(f"  src: {', '.join(srcs)};")
@@ -58,6 +59,7 @@ def generate_fonts_css(fonts_dir, output_path, fonts_cfg=None):
     logging.info(f"[✓] Generated fonts CSS: {output_path}")
     return preload_links
 
+
 def generate_google_fonts_link(fonts):
     """Generate src link for Google fonts"""
     if not fonts:
@@ -70,5 +72,9 @@ def generate_google_fonts_link(fonts):
             families.append(f"{family}:wght@{';'.join(weights)}")
         else:
             families.append(family)
-    href = "https://fonts.googleapis.com/css2?" + "&".join(f"family={f}" for f in families) + "&display=swap"
+    href = (
+        "https://fonts.googleapis.com/css2?"
+        + "&".join(f"family={f}" for f in families)
+        + "&display=swap"
+    )
     return f'<link href="{href}" rel="stylesheet">'