feat: Add CI and CD workflows for automated build, testing, and release

[Wembie]

No description provided.

[Copilot]

Pull request overview

Adds GitHub Actions CI/CD automation for the SENTINEL Python package, alongside dependency and small codebase cleanups to support consistent linting/testing and versioning.

Changes:

• Introduces CI workflow to enforce VERSION bumping and run ruff/black/mypy/pytest (with coverage).
• Introduces CD workflow to build artifacts and create a tag + GitHub Release when VERSION changes on main.
• Updates packaging/dev-dependency configuration (uv groups) and performs minor typing/formatting refactors across the codebase.

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
VERSION	Bumps project version to 0.1.4.
uv.lock	Adds coverage/pytest-cov and updates lock metadata for new dev dependency grouping.
sentinel/rules/builtin/injection.py	Minor regex string formatting consistency changes.
sentinel/rules/builtin/auth.py	Formatting/line-wrapping adjustments to patterns and exploit-chain construction.
sentinel/reporting/sarif_reporter.py	Minor formatting change for locations fallback expression.
sentinel/reporting/markdown_reporter.py	Minor formatting change in markdown table header lines.
sentinel/parsers/treesitter.py	Splits multi-import for clarity/formatting.
sentinel/models/graph.py	Migrates enum types to StrEnum (Py 3.11+) for better string-enum ergonomics.
sentinel/models/finding.py	Migrates to StrEnum and uses datetime.UTC in default timestamp.
sentinel/models/audit.py	Migrates to StrEnum, tightens typing, and cleans up annotations.
sentinel/mcp.py	Formatting cleanup; adds debug logging for parse failures; minor refactors for readability.
sentinel/logging.py	Improves typing and readability around structlog processor configuration.
sentinel/llm/openai.py	Minor formatting of structured-system prompt assembly.
sentinel/llm/claude.py	Minor formatting of structured-system prompt assembly.
sentinel/graph/builder.py	Formatting + safer string conversion for AST child text extraction.
sentinel/graph/backend.py	Formatting cleanup in list comprehensions / path finding.
sentinel/core/registry.py	Improves typing for decorator registration and removes type: ignore via cast().
sentinel/core/pipeline.py	Updates return type annotation to non-string form (relies on future annotations).
sentinel/core/engine.py	Uses datetime.UTC; removes unused import; uses zip(..., strict=True) for safer pairing.
sentinel/config.py	Formatting cleanup in settings source tuple return.
sentinel/cli.py	Typing improvements, Optional modernizations, and some formatting tidy-ups.
pyproject.toml	Moves dev deps to [dependency-groups], adds pytest-cov, and updates ruff ignores.
.github/workflows/ci.yml	Adds CI workflow (lint/format/typecheck/tests + VERSION bump gate).
.github/workflows/cd.yml	Adds CD workflow (build + tag/release on VERSION change).
.flake8	Simplifies flake8 config (now only ignores E501).

[Wembie]

@copilot apply changes based on this feedback

[Copilot]

Implemented in 48dd2ed: CD now checks VERSION changes across the full push range (${{ github.event.before }}..${{ github.sha }}), with a null-SHA fallback path, so multi-commit pushes won’t miss a VERSION bump.

[Wembie]

@copilot apply changes based on this feedback

[Copilot]

Applied in b886a34: CD no longer relies on workflow-time manifest mutation for release output correctness; it now runs sync_version.py and fails if any workspace changes are introduced, so releases only proceed when synced manifest updates are already committed.

[Wembie]

@copilot apply changes based on this feedback

[Copilot]

Implemented in b0cae5c: CI now trims whitespace from base/head VERSION values, validates both as semver, and then checks that VERSION was actually bumped. No UI changes in this update.