chore: integrate SAST and OpenEnv validation to CI workflow

.github/workflows/code-quality.yml

@@ -26,9 +26,17 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install ruff mypy pydantic vulture radon
+        pip install ruff mypy pydantic vulture radon bandit openenv-core
         pip install -e ".[dev,demo]"
 
+    - name: Security SAST with Bandit
+      run: |
+        python -m bandit -r . -c pyproject.toml
+
+    - name: OpenEnv validation
+      run: |
+        openenv validate .
+
     - name: Lint and Format with Ruff
       run: |
         ruff check . --output-format=github
@@ -87,7 +95,7 @@ jobs:
         node-version: '24'
 
     - name: Install jscpd
-      run: npm install -g jscpd
+      run: npm install -g jscpd@4.0.0
 
     - name: Check for duplicate code
-      run: jscpd . --ignore "**/*.json,**/*.md,**/*.yaml,**/*.yml,**/package-lock.json,**/node_modules/**,**/venv/**,**/.venv/**" --threshold 5
+      run: jscpd . --ignore "**/*.json,**/*.md,**/*.yaml,**/*.yml,**/package-lock.json,**/node_modules/**,**/venv/**,**/.venv/**,**/dist/**,**/build/**" --threshold 5

CYCLE_8_REPORT.md

@@ -0,0 +1,39 @@
+# Cycle 8 Report
+
+## Repository Health Report
+- **Strengths:** Strong server-side CI pipeline ensuring formatting, mypy typing, dead code detection, and python unit tests run on all pushes and PRs.
+- **Weaknesses:** CI pipeline lacks Bandit SAST scanning and OpenEnv environment validation, which currently only run locally. Furthermore, duplicate code detection using `jscpd` fails due to unpinned dependencies (v5 incompatibilities) and noise from build artifacts.
+- **Risks:** Missing server-side SAST and OpenEnv validation allows code with security vulnerabilities or broken environments to be merged. The failing `jscpd` step causes CI noise, and false positives in artifacts reduce developer trust in automated feedback.
+- **Opportunities:** Integrate Bandit SAST and OpenEnv validation directly into the `code-quality.yml` GitHub Actions workflow. Fix the duplicate code detection by pinning `jscpd` to a stable version (4.0.0) and ignoring build artifacts (`dist` and `build` directories).
+
+## Competitor Analysis
+- **Repositories Analyzed:** Open source deep learning frameworks and secure AI environments.
+- **Advantages Discovered:** High-performing repositories have strict CI pipelines that do not leave gaps between local validation and server-side checks. They enforce consistent, stable tooling versions for static analysis.
+- **Gaps Identified:** This repository currently enforces SAST and OpenEnv validation locally via bash scripts, but the server CI pipeline does not mirror these checks. The duplicate code step in CI is unreliable.
+- **Opportunities to Outperform:** By mirroring local security and environment checks in CI, and by fixing the `jscpd` stability issue, we create an impenetrable quality gate that guarantees zero drift between local and server checks.
+
+## Priority Improvements
+1. **Fix and Optimize Duplicate Code Detection:** Pin `jscpd` to `4.0.0` and ignore `**/dist/**` and `**/build/**` in `.github/workflows/code-quality.yml`.
+2. **Add SAST and Environment Validation to CI:** Install and execute `bandit` and `openenv validate` in the Python quality CI job.
+
+## Sprint Plan
+- **Sprint Goal:** Close the gap between local validation and server CI by adding missing security/environment checks, and stabilize the CI pipeline by fixing duplicate code detection errors.
+- **Tasks:**
+  1. Write `CYCLE_8_REPORT.md` to document the strategy.
+  2. Update `.github/workflows/code-quality.yml`:
+     - Modify `python-quality` job to install `bandit` and `openenv-core`.
+     - Add execution steps for `bandit` and `openenv validate .`.
+     - Modify `duplicate-code` job to pin `jscpd@4.0.0`.
+     - Update `jscpd` command to ignore `**/dist/**` and `**/build/**`.
+  3. Validate updates locally to ensure syntax and standards pass.
+- **Implementation Roadmap:** Write report -> Update `code-quality.yml` -> Local Validation -> Commit and Push.
+- **Expected Outcomes:** CI pipeline successfully catches SAST and OpenEnv issues on pull requests. The `jscpd` step passes reliably without platform dependency errors or false positives from compiled output.
+
+## Technical Improvements
+- **DevOps/CI:** Extended the server-side GitHub Actions pipeline to include Bandit SAST and OpenEnv validation, bringing CI up to parity with local `.validate-submission.sh` checks. Fixed CI instability by correctly pinning the `jscpd` tool version.
+- **Security:** Added an automated static analysis security quality gate to the CI flow.
+
+## Metrics Improved
+- **CI Reliability:** Reduced false CI failures by fixing the duplicate code detection step.
+- **Security Posture:** 100% of future commits will be automatically scanned by Bandit SAST.
+- **Code Quality:** Environment definition (`openenv.yaml`) regressions will be caught before merge.