ci: add CI (compile/lint/tests/audit) + Dependabot

[jhamon]

Adds CI to a repo that had tests (tests/test_query.py, 10 mocked unit tests) but no CI. Jobs: compile + ruff error-lint + mocked unit tests (dummy PINECONE_API_KEY; live tests excluded) + pip-audit. Plus least-privilege permissions and Dependabot (pip + github-actions). Verified locally: 10 tests pass, ruff clean, pip-audit clean.

---

Note

Low Risk
Changes are limited to GitHub workflow and Dependabot config; no application or dependency version changes in this diff.

Overview
Introduces GitHub Actions CI and Dependabot for a repo that already had mocked unit tests but no automation.

The ci.yml workflow now runs on pushes to main and on PRs, with concurrency so in-flight runs cancel when a newer commit lands. The test job upgrades the runner to Python 3.12 (with pip cache), sets a dummy PINECONE_API_KEY so mocked tests can run without secrets, and adds byte-compile, Ruff checks (error-level rules only), and verbose pytest on tests/test_query.py instead of only running pytest. A separate audit job runs pip-audit against requirements.txt.

dependabot.yml schedules weekly updates for pip (minor/patch grouped, cap of 10 open PRs) and github-actions (cap of 5).

^{Reviewed by Cursor Bugbot for commit 117efdd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 117efdd. Configure here.}

[cursor]

CI pytest hardcodes test filename

Medium Severity

CI invokes pytest on the hardcoded file tests/test_query.py instead of auto-discovering unit tests. Offline unit tests and live integration tests are not split with pytest markers or directories, so the workflow cannot use a stable command such as pytest tests/ -m "not live" and will miss new unit tests unless the workflow is edited.

 

^{Triggered by learned rule: CI pytest must auto-discover unit tests}

^{Reviewed by Cursor Bugbot for commit 117efdd. Configure here.}