ci: complete audit B1 readiness checks

[MichaelFisher1997]

Summary

• Adds ShellCheck validation via Nix, commits .shellcheckrc, and fixes reported script warnings.
• Makes benchmark comparison fail on placeholder baselines and regressions beyond explicit 5% warning / 10% failure thresholds.
• Shrinks the benchmark workflow to a bounded 5-second canary per low/medium/high preset, avoids nested Nix, sets dummy SDL audio, uses a writable Mesa cache, and adds per-preset hard timeouts.
• Adds SECURITY.md, CODEOWNERS, Contributor Covenant 2.1, README security link, and actions/stale workflow.

Issue Links

Closes #860
Closes #861
Closes #862
Closes #863

Verification

• nix develop .#ci-unit --command shellcheck scripts/*.sh
• nix develop .#ci-unit --command bash -n scripts/*.sh
• git pre-push hook passed: nix develop --command zig fmt --check src/
• git pre-push hook passed: nix develop --command zig build test

Operations Notes

• Branch protection should require CODEOWNERS review for the paths in .github/CODEOWNERS.
• actions/stale dry-run is available via manual workflow_dispatch with dry-run=true.
• Benchmark workflow was reduced from a long default run to a short canary to avoid expensive dev-push slowdown; longer profiling remains available by passing a larger manual duration.

[github-actions]

📋 Summary

This PR closes #860 (ShellCheck validation), #861 (benchmark regression gating), #862 (benchmark canary/timeout), and #863 (security docs, CODEOWNERS, stale workflow). The changes align with the described scope: ShellCheck is wired into the flake and CI, benchmark comparison now fails on placeholder baselines and enforces 5%/10% thresholds, the benchmark job is bounded to a 5-second canary with per-preset timeouts and dummy audio, and the new governance docs/workflow are present. I ran shellcheck and bash -n on the modified scripts locally; both passed.

📌 Review Metadata

• Reviewed Commit SHA: c9818a96e1c34e9cec1bf489a24e693cc914d1a0
• Reviewed PR: ci: complete audit B1 readiness checks #883

🔴 Critical Issues

None identified.

⚠️ High Priority Issues

[HIGH] .github/CODEOWNERS:2-5 - CODEOWNERS patterns are not recursive
Confidence: High
Description: The patterns modules/engine-graphics/, modules/world-persistence/, and assets/shaders/ match only files directly in those directories, not in subdirectories. In this repository, the engine graphics code lives under modules/engine-graphics/src/** (e.g., src/vulkan/), persistence code under modules/world-persistence/src/, and shaders under assets/shaders/vulkan/. As written, the CODEOWNERS file will not enforce required review on the vast majority of the files it is intended to protect.
Impact: Branch protection with "require CODEOWNERS review" will be effectively bypassed for the high-risk engine, persistence, and shader paths the PR is meant to safeguard.
Suggested Fix: Use recursive globs:

modules/engine-graphics/**   @OpenStaticFish
modules/world-persistence/** @OpenStaticFish
assets/shaders/**            @OpenStaticFish
.github/workflows/**         @OpenStaticFish

💡 Medium Priority Issues

None identified.

ℹ️ Low Priority Suggestions

[LOW] .github/workflows/benchmark.yml:97-98 - Dead compareOutcome === 'skipped' branch
Confidence: High
Description: scripts/compare_benchmarks.sh now exits with code 1 for placeholder baselines, so the comparison step is never skipped. The ternary branch in the commit-status description is unreachable.
Impact: No runtime harm, but it leaves misleading status logic.
Suggested Fix: Remove the compareOutcome === 'skipped' branch or map it to a neutral description.

📊 SOLID Principles Score

Principle	Score	Notes
Single Responsibility	9	Each workflow/script has a focused, single purpose.
Open/Closed	8	Scripts are parameterized and extensible without modification.
Liskov Substitution	10	No inheritance or polymorphism in this CI/docs change.
Interface Segregation	9	Workflows expose only needed inputs; flake shells are well-scoped.
Dependency Inversion	8	Build logic depends on the Nix/GitHub Actions abstractions as expected.
Average	8.8

🎯 Final Assessment

Overall Confidence Score: 75%

Confidence Breakdown:

• Code Quality: 85% (scripts are clean, ShellCheck-clean, and well-structured)
• Completeness: 70% (issues are addressed, but the CODEOWNERS implementation misses the intended paths)
• Risk Level: 75% (CI-only changes; risk is contained, but broken CODEOWNERS weakens governance)
• Test Coverage: 80% (verification commands listed and shell-level checks pass)

Merge Readiness:

• All critical issues resolved
• SOLID average score >= 6.0
• Overall confidence >= 60%
• No security concerns (CODEOWNERS governance gap)
• Tests present and passing (if applicable)

Verdict:

MERGE WITH FIXES — Fix the CODEOWNERS recursive patterns before merging; everything else is ready.

{
  "reviewed_sha": "c9818a96e1c34e9cec1bf489a24e693cc914d1a0",
  "critical_issues": 0,
  "high_priority_issues": 1,
  "medium_priority_issues": 0,
  "overall_confidence_score": 75,
  "recommendation": "MERGE WITH FIXES"
}

opencode session  |  github run

[github-actions]

📋 Summary

This PR closes #860 (ShellCheck validation), #861 (benchmark regression gating), #862 (benchmark canary/timeout), and #863 (security docs, CODEOWNERS, stale workflow). The implementation matches each issue: ShellCheck is wired into the flake and CI, benchmark comparison now rejects placeholder baselines and applies 5%/10% thresholds, the benchmark job is bounded to a 5-second canary with per-preset timeouts and dummy audio, and governance docs plus the stale workflow are added. Overall this is a focused, well-structured CI/docs improvement.

📌 Review Metadata

• Reviewed Commit SHA: 635ec7d763c8a4864294f72ca089c8ec8d7b0c49
• Reviewed PR: ci: complete audit B1 readiness checks #883

🔴 Critical Issues

None identified.

⚠️ High Priority Issues

✅ All previously reported high priority issues have been resolved.

• ✅ [FIXED] Previous issue: .github/CODEOWNERS:2-5 patterns were not recursive; they now use /** globs (modules/engine-graphics/**, modules/world-persistence/**, assets/shaders/**, .github/workflows/**) so required owner review will apply to subdirectories.

💡 Medium Priority Issues

None identified.

ℹ️ Low Priority Suggestions

✅ All previously reported low priority issues have been resolved.

• ✅ [FIXED] Previous issue: .github/workflows/benchmark.yml:97-98 had a dead compareOutcome === 'skipped' branch; the branch has been removed and the status description is now simplified.

📊 SOLID Principles Score

Principle	Score	Notes
Single Responsibility	9	Each workflow/script has a focused, single purpose.
Open/Closed	8	Scripts are parameterized and extensible without modification.
Liskov Substitution	10	No inheritance or polymorphism in this CI/docs change.
Interface Segregation	9	Workflows expose only needed inputs; flake shells are well-scoped.
Dependency Inversion	8	Build logic depends on the Nix/GitHub Actions abstractions as expected.
Average	8.8

🎯 Final Assessment

Overall Confidence Score: 85%

Confidence Breakdown:

• Code Quality: 90% (scripts are clean, ShellCheck-clean, and well-structured)
• Completeness: 85% (all linked issues are addressed and the previous CODEOWNERS/branch issues are fixed)
• Risk Level: 85% (CI-only and docs changes; risk is contained)
• Test Coverage: 85% (verification commands listed and shell-level checks pass)

Merge Readiness:

• All critical issues resolved
• SOLID average score >= 6.0
• Overall confidence >= 60%
• No security concerns
• Tests present and passing (if applicable)

Verdict:

MERGE — Previous review issues are fixed and the current changes are ready to merge.

{
  "reviewed_sha": "635ec7d763c8a4864294f72ca089c8ec8d7b0c49",
  "critical_issues": 0,
  "high_priority_issues": 0,
  "medium_priority_issues": 0,
  "overall_confidence_score": 85,
  "recommendation": "MERGE"
}

opencode session  |  github run