Set up GitHub Actions (deepseek, gpt, dependency review, workflow lint, CodeQL, PR lint, cicaid updates)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,62 @@
+---
+name: Bug report
+about: Report something that is broken or behaving incorrectly
+title: ""
+labels: bug
+assignees: ""
+---
+
+## What
+
+<!-- What is broken? Describe the observed behavior, including exact error
+messages, screenshots, or logs where relevant. -->
+
+## Why
+
+<!-- Why does this matter? What's the user/dev impact of leaving it broken? -->
+
+## How
+
+<!-- Steps to reproduce, and (if you know it) what the fix likely involves. -->
+
+1.
+2.
+3.
+
+**Expected behavior:**
+
+**Actual behavior:**
+
+**Environment:** (backend/frontend/CDK, browser, OS, commit/branch)
+
+## Files Affected
+
+<!-- List the specific file paths (from the repo root) that need to be
+changed, added, or deleted to fix this. Use one path per line. -->
+
+## Constraints
+
+<!-- Anything the fix must not break, e.g. "must not change the public API
+shape" or "must preserve bash/PowerShell parity". -->
+
+## LLM tier
+
+<!-- If this will be worked by an AI agent, suggest a tier: haiku / sonnet / opus -->
+
+## Value
+
+<!-- How much impact/priority does this have: Low Value / Medium Value / High Value
+- High Value: real bugs, security/auth gaps, financial-data correctness issues,
+  or substantive product features.
+- Medium Value: reliability/observability improvements with real (if non-urgent)
+  blast radius, or consolidated multi-item hardening/test-coverage backlogs.
+- Low Value: single-file "add a test for X" / rename / doc-comment /
+  formatting-only suggestions with no functional risk. -->
+
+## Success looks like
+
+- [ ]
+
+## Failure looks like
+
+-

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,2 @@
+blank_issues_enabled: true
+contact_links: []

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,55 @@
+---
+name: Feature request
+about: Propose a new feature or enhancement
+title: ""
+labels: enhancement
+assignees: ""
+---
+
+## What
+
+<!-- What should be built or changed? -->
+
+## Why
+
+<!-- Why is this needed? What problem does it solve, or what value does it add? -->
+
+## How
+
+<!-- Outline the intended approach at a high level. Link to affected files or
+areas of the codebase if known. -->
+
+## Files Affected
+
+<!-- List the specific file paths (from the repo root) that need to be
+changed, added, or deleted to implement this. Use one path per line. -->
+
+## Constraints
+
+<!-- Anything the implementation must respect, e.g. "no application code
+changes", "must confirm licensing decisions before implementing", scope
+boundaries, backwards compatibility requirements. -->
+
+## LLM tier
+
+<!-- If this will be worked by an AI agent, suggest a tier and briefly justify
+it: haiku (mechanical/additive) / sonnet (judgment required) / opus (complex,
+cross-cutting) -->
+
+## Value
+
+<!-- How much impact/priority does this have: Low Value / Medium Value / High Value
+- High Value: real bugs, security/auth gaps, financial-data correctness issues,
+  or substantive product features.
+- Medium Value: reliability/observability improvements with real (if non-urgent)
+  blast radius, or consolidated multi-item hardening/test-coverage backlogs.
+- Low Value: single-file "add a test for X" / rename / doc-comment /
+  formatting-only suggestions with no functional risk. -->
+
+## Success looks like
+
+- [ ]
+
+## Failure looks like
+
+-

.github/ISSUE_TEMPLATE/task_chore.md

@@ -0,0 +1,55 @@
+---
+name: Task/Chore
+about: Non-feature, non-bug maintenance work (refactoring, dependency updates, CI improvements)
+title: ""
+labels: chore
+assignees: ""
+---
+
+## What
+
+<!-- What maintenance work needs to be done? -->
+
+## Why
+
+<!-- Why is this needed now? What risk, drift, or friction does it address? -->
+
+## How
+
+<!-- Outline the intended approach at a high level. Link to affected files or
+areas of the codebase if known. -->
+
+## Files Affected
+
+<!-- List the specific file paths (from the repo root) that need to be
+changed, added, or deleted to implement this. Use one path per line. -->
+
+## Constraints
+
+<!-- Anything the implementation must respect, e.g. "no behavior changes",
+"must confirm licensing decisions before implementing", scope boundaries,
+backwards compatibility requirements. -->
+
+## LLM tier
+
+<!-- If this will be worked by an AI agent, suggest a tier and briefly justify
+it: haiku (mechanical/additive) / sonnet (judgment required) / opus (complex,
+cross-cutting) -->
+
+## Value
+
+<!-- How much impact/priority does this have: Low Value / Medium Value / High Value
+- High Value: real bugs, security/auth gaps, financial-data correctness issues,
+  or substantive product features.
+- Medium Value: reliability/observability improvements with real (if non-urgent)
+  blast radius, or consolidated multi-item hardening/test-coverage backlogs.
+- Low Value: single-file "add a test for X" / rename / doc-comment /
+  formatting-only suggestions with no functional risk. -->
+
+## Success looks like
+
+- [ ]
+
+## Failure looks like
+
+-

.github/cicaid-pins.env

@@ -0,0 +1,15 @@
+# Versions of cicaid-devtools / cicaid-devtools-pro that this repo's AI
+# PR review workflow installs.
+#
+# This lives outside .github/workflows/ on purpose: GitHub hard-blocks a
+# workflow's default GITHUB_TOKEN from pushing any change under that
+# directory, whatever permissions the job is granted, so a pin written
+# inline in a workflow file could only ever be bumped by a PAT carrying
+# the `workflow` scope. Here, the scheduled update workflow bumps it
+# unattended (update-cicaid.yml; update-dependencies.yml in cicaid-pro).
+#
+# Managed by `cicaid setup-review-actions` and by that update workflow.
+# Only KEY=<tag> lines are honoured -- both the install step and the
+# updater reject anything else rather than run it.
+CICAID_REF=v0.5.0
+CICAID_PRO_REF=v0.14.1

.github/cicaid-scaffold.json

@@ -0,0 +1,19 @@
+{
+  "files": {
+    ".github/ISSUE_TEMPLATE/bug_report.md": "2fa6568cac6693bdea18698841b99c5c473dae7df31dd249ebe588fff7bbb237",
+    ".github/ISSUE_TEMPLATE/config.yml": "e71bea835ed1158881306294d96968f125b0b0c5eff66cd94df559336bd0b210",
+    ".github/ISSUE_TEMPLATE/feature_request.md": "bb7068f2d817a657c81fbbb7875fd5bfc28b922c70467ea0277bd574dea1b7f3",
+    ".github/ISSUE_TEMPLATE/task_chore.md": "f2feb8aa218868b9dfba30350b85dd4b44bf4c54a1c976b13290c1b12a551f08",
+    ".github/cicaid-pins.env": "86d6783d9a82a750c28072ea39ec83e39c3c8952a4623aeae76b670d14ccd134",
+    ".github/scripts/pip_install_cicaid_pro.sh": "f1f96ec858e887ecebde64220b6ed88bc52100aa58fb4bf2513cbadbe4548b1d",
+    ".github/scripts/update_cicaid_pins.py": "18aa919e79912988962c80e4880a204f785daf2ec3731ed0c9b4205bc62970f4",
+    ".github/workflows/_ai-pr-review.yml": "8ad950bed5510c1c778721cac752afc10da2b6b5c3c966f3fb3cd4bfd495c110",
+    ".github/workflows/codeql.yml": "82a8ea8a436aab174794580f4bd320f31c588f2e33a670193858e1b3a76ae677",
+    ".github/workflows/deepseek-pr-review.yml": "0968093290f53e966d3b2b5675f3625ec68e80fcaba27f44a85706779e051913",
+    ".github/workflows/dependency-review.yml": "f1ea2e8a7c6c7ba6f855fd57bcd6ca94998ac9278c52dad7ffcf8ec0bb30dcba",
+    ".github/workflows/gpt-pr-review.yml": "01ea72c61fcda1592f1ab44bf16e207a00ef6d6554ca095c3cf808a2ca4f1d46",
+    ".github/workflows/pr-lint.yml": "a0e12bf2c14acbf0a4ce1a86b79a358528212b59bc0a56cec3ccbfd4f1d66d2b",
+    ".github/workflows/update-cicaid.yml": "07c6345ab47761e8d2edda2a6ffd4c873a3c00d47fb7c15eec510c9a5759ecb6",
+    ".github/workflows/workflow-lint.yml": "640d1968ff710b475f913ec4681dfe1370b86a63fe7674f0f01ca4c885fb030b"
+  }
+}

.github/scripts/pip_install_cicaid_pro.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Runs a command (typically a pip install) with git credentials configured so it
+# can clone the private leonarduk/cicaid-pro repo. The AI-review modules the
+# generated workflows import (review_diff, review_comment, deepseek_review,
+# gpt_review, etc.) only exist in cicaid-pro, not the public leonarduk/cicaid
+# "free shell" package, so a plain pip install of the public wheel/repo 404s
+# or is missing these modules.
+#
+# Fails fast with an actionable message if CICAID_PRO_TOKEN is unset or empty,
+# instead of letting the wrapped command fail later with a confusing git auth
+# error. The credential rewrite is scoped to exactly this invocation through
+# Git's GIT_CONFIG_* environment variables; the token is never written to a
+# config file.
+#
+# Uses `url.<base>.insteadOf` with the token embedded as URL userinfo, rather
+# than a `credential.<url>.helper` shell snippet that reads the token from the
+# env var at request time. The helper form looks more secure on paper (the raw
+# token never touches disk), but empirically it is NOT reliable here: any
+# pre-existing generic `credential.helper` (e.g. Git Credential Manager, or a
+# local `gh auth login`) is consulted first and can supply -- or fail to yield
+# to -- a different credential before a URL-scoped helper ever runs, since
+# helpers accumulate across config scopes rather than "most specific wins".
+# The `insteadOf` rewrite has no such ambiguity: the token is embedded
+# directly in the URL, which git's transport layer uses unconditionally
+# without consulting the credential-helper chain at all. GitHub's own PAT
+# formats (ghp_/github_pat_/gho_/ghs_/ghr_) are always alphanumeric and never
+# contain the URL-reserved characters (@, :, /) that would make this rewrite
+# unsafe, so that's not a practical concern for the token this script expects.
+#
+# Usage: pip_install_cicaid_pro.sh <command...>
+# Required env: CICAID_PRO_TOKEN
+set -euo pipefail
+
+if [ -z "${CICAID_PRO_TOKEN:-}" ]; then
+  echo "::error::CICAID_PRO_TOKEN is empty or unset. Add a fine-grained PAT (Contents: Read-only, scoped to leonarduk/cicaid-pro) as the CICAID_PRO_TOKEN repository secret (Settings > Secrets and variables > Actions) before this workflow can install cicaid-devtools-pro." >&2
+  exit 1
+fi
+
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0="url.https://x-access-token:${CICAID_PRO_TOKEN}@github.com/leonarduk/cicaid-pro.insteadOf"
+export GIT_CONFIG_VALUE_0="https://github.com/leonarduk/cicaid-pro"
+
+exec "$@"