Summary
Add standard quality and security scanners instead of relying only on custom checks.
Candidate tools
- ShellCheck for shell scripts
- Trivy for container/filesystem vulnerability scanning
- axe-core or Lighthouse CI for dashboard accessibility checks
Acceptance criteria
- CI has documented, repeatable scanner jobs or release-gate steps.
- Required scanner dependencies are pinned or installed through standard images/actions.
- Findings are scoped to actionable release surfaces to avoid noisy non-blocking research artifacts.
- Existing custom policy checks remain only where they encode WineBot-specific requirements.
Recommendation
Implement as staged CI hardening after PR #89 is green. Start with ShellCheck and Trivy; add axe-core/Lighthouse once dashboard release criteria are finalized.
Trade-offs
Standard scanners improve practitioner trust and reduce custom maintenance. The main cost is triaging initial findings and deciding which checks are blocking versus advisory.
Summary
Add standard quality and security scanners instead of relying only on custom checks.
Candidate tools
Acceptance criteria
Recommendation
Implement as staged CI hardening after PR #89 is green. Start with ShellCheck and Trivy; add axe-core/Lighthouse once dashboard release criteria are finalized.
Trade-offs
Standard scanners improve practitioner trust and reduce custom maintenance. The main cost is triaging initial findings and deciding which checks are blocking versus advisory.