ci: add required test and container gates

[cywf]

Summary

• expand the existing validate workflow with real unit, container-smoke, exact-head independent-review, and aggregate Required CI jobs
• require codex/*, a non-draft PR, and genuine exact-head review evidence
• replace the placeholder container that invoked a nonexistent binary with a non-root static-site runtime
• build all eight Astro routes with live repository data and serve them through unprivileged nginx
• pass the scoped GitHub Actions token to the build only through a required BuildKit secret mount; do not persist it as an image argument or environment variable
• add a focused unit test for professional-email draft generation
• track a Docker build-context allowlist and upgrade checkout to v4

Validation

Executed on g8s-node-2 at exact head 2d6b57203bd72a271ff40912386a25b6a82bfc50:

• Python compilation passed for scripts/
• 1 focused unit test passed
• actionlint passed for .github/workflows/spec-kit.yml
• git diff --check passed
• a build without the required secret failed closed
• a secret-backed site image built successfully
• generated repository JSON was valid and known mock records were absent
• the final image configuration contained no GITHUB_TOKEN
• the running container reached healthy, served the root route, the nested /FortiPath/ route, and an emitted asset, and ran as non-root UID 101

Agent quality evidence

Role	Concrete agent or run ID	Evidence
Implementer	node2-codex-2d6b572	Implemented and validated the BuildKit secret path and complete guardrail set at exact head 2d6b57203bd72a271ff40912386a25b6a82bfc50.
Independent reviewer	G1-Maria/direct-1784548174	PASS on the code and security controls at exact head 2d6b57203bd72a271ff40912386a25b6a82bfc50: no P1 or P2 findings; the only release-gate failure reported was this row's previously stale SHA, now corrected.
Test verifier	node2-tests-2d6b572	PASS at exact head 2d6b57203bd72a271ff40912386a25b6a82bfc50: missing-secret fail-closed check, secret-backed image build, generated-data validation, mock-data exclusion, token non-persistence, unit, actionlint, container route/asset/non-root checks, and diff check.

Risk and follow-up

The GitHub Actions token is scoped to the workflow and exposed only to the single fetch/build step through BuildKit's ephemeral secret mount. It is not declared through ARG or ENV, and only generated static assets are copied into the runtime image. The existing site dependency graph nevertheless reports known build-time advisories and needs a separately reviewed framework migration. The aggregate intentionally fails closed for drafts, non-codex/* branches, stale review evidence, or any failed validation job.

Rollback: revert this PR's squash commit. No branch-protection relaxation or runtime credential rotation is included.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 178b2cf689

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cywf]

Independent review — FortiPath PR #65

Exact head: 4cabd59ecb0773c2c3470e232ca3ae9f6b0c5dcb
Status: Draft — no protection changes, no conversation resolution

Scope verified in diff

File	Change
infra/nginx.conf	New — /FortiPath redirect + ^~ /FortiPath/ rewrite block, security headers
infra/Dockerfile	Multi-stage: node:22-alpine build → nginxinc/nginx-unprivileged:1.27-alpine runtime, HEALTHCHECK
.dockerignore	New — 9-entry build-context allowlist
tests/test_professional_emails.py	New — 1 unit test for email draft generation
.github/workflows/spec-kit.yml	Expanded with unit, container-smoke, review-evidence, and aggregate gates

Node evidence (local on g8s-node-2)

Check	Result	Evidence
Python unit test	PASS	1/1 passed (test_generates_expected_professional_fields)
Site build	PASS	Astro build completed, 8 routes generated
Docker build	PASS	Image built successfully
Root route smoke	PASS	curl http://127.0.0.1:8080/ → HTTP 200
Nested /FortiPath/ route	PASS	curl http://127.0.0.1:8080/FortiPath/development-board/ → HTTP 200
Emitted asset	PASS	/FortiPath/_astro/ asset found in page HTML and served
Non-root	PASS	Container runs as UID 101 (nginxinc/nginx-unprivileged)
Diff check	PASS	git diff --check clean

CI run 29732010720

Job	Result	Detail
Unit tests	PASS ✓
Container smoke test	PASS ✓	Build, root route, nested route, emitted asset, non-root, cleanup
validate	PASS ✓
Independent review evidence	failure	Expected — draft PR, no review evidence yet
Required CI	failure	Expected — cascaded from review evidence gate

Verdict: PASS

All node evidence and CI jobs (except the draft-PR gate) pass. The Required CI failure is the gate correctly failing closed for a draft PR with no review evidence — not a code defect.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4cabd59ecb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".