chore(ci): add CI workflow and Dependabot hardening

[t0kubetsu]

Closes #115

Summary

Add CI pipeline (ShellCheck + Ansible Lint) and Dependabot hardening. CI-only — no source scripts touched.

Commits

• 9a2d0b0 chore(ci): add CI workflow and Dependabot hardening
• 616bb05 fix(ci): add ca-certificates to debian:trixie-slim apt install
• d01a350 ci(workflow): fix push branch triggers — feat/** + fix/** replace feature/**
• dd00c8d fix(ci): bump actions/checkout from v4 to v6

Changes

• .github/workflows/ci.yml — shellcheck on debian:trixie-slim, ansible-lint on python:3.13-slim; push triggers cover feat/** and fix/** branches; actions/checkout@v6
• .github/dependabot.yml — automated github-actions dependency updates

Not included

SC2034 dead variable fixes (devkit_proxmox.STDIN.normalize.to.jsons.sh, proxmox_vm.vm_id.get_usage.to.jsons.sh) are in PR #118.

Test plan

• CI runs green on this PR
• Dependabot alerts enabled in repo settings

[pparage]

Review — needs author input

Adds a ShellCheck job and an ansible-lint job. The ShellCheck half is a good fit for this repo — 106 shell scripts and --severity=warning keeps it to things that actually bite. The ansible-lint half is configured differently from its three siblings in a way that looks unintentional, and I could not run either gate here to tell you which way it lands.

Blocking

• none confirmed — but see the question below, which decides whether this merges green or permanently red.

Question — the ansible-lint job

.github/workflows/ci.yml:26 runs ansible-lint . --profile=production, and this PR adds no .ansible-lint config. The other three PRs in this set all do, and all of them select profile: basic plus a skip list:

PR	profile	config added
range42#214	basic	yes
range42-catalog#183	(config added)	yes
range42-playbooks#81	basic	yes
this one	production	no

production is ansible-lint's strictest profile — it layers basic → moderate → safety → shared → production and adds rules like mandatory meta/main.yml fields, name[casing], FQCN enforcement and no-ignore_errors. The three siblings needed a skip list to pass on basic; this repo is operator tooling that has never been linted, and it is being held to the strictest setting with no skips at all.

Was production deliberate, or copied from a template? If deliberate, it likely needs the same kind of skip list the siblings carry. Happy to be wrong — I could not run it to check.

Non-blocking

• .github/workflows/ci.yml:14,25 — shellcheck comes from debian:trixie-slim and ansible-lint from unpinned pip, so both gates can change strictness without a repo change. Pinning ansible-lint==x.y.z at least makes the lint side reproducible.
• ansible-lint . scans the whole tree including any future .github/ YAML; the siblings scope theirs (ansible-lint bundles/). Scoping to the roles/playbooks directories would keep the signal tighter.

Cross-repo

• None. CI configuration only — no script, role or naming-contract change, so nothing in range42-playbooks or range42-catalog is affected.
• One of four siblings; no merge ordering between them.

Verification

• shellcheck --severity=warning on all 106 *.sh — not run, shellcheck is not installed here and the routine does not install system-wide.
• ansible-lint . --profile=production — not run, same reason. This is the gate the question above turns on; neither of us should assume it is green until someone runs it.
• Confirmed by reading: no .ansible-lint exists on dev or in this diff; 106 *.sh files in the tree.
• Secrets pass on the diff — clean.
• Staleness: opened 2026-06-09, no commits in ~2 months. Still applies — no CI workflow on dev today.

Per this repo's standing bar these are operator tools held to "safe and correct" rather than polished, so I have not raised anything about script ergonomics or missing tests.

---

Generated by Claude Code

[t0kubetsu]

@pparage good catch — pushed dd00c8d..7b969ff:

Your question (production profile — deliberate or template?): template copy-paste, but the real answer is more fundamental: this repo has no Ansible YAML at all. Despite the name, the tree is 106 shell scripts, ansible.cfg variants, Python callback plugins and JSON examples — the only .yml files are .github/ itself, which is exactly what ansible-lint . would have been linting. So rather than downgrading the profile, the job is removed, with a comment in the workflow saying to re-add it (profile basic + .ansible-lint, like the siblings) if roles/playbooks ever land here. That also moots the ansible-lint pin and path-scoping points.

ShellCheck verification (you couldn't run it): ran shellcheck --severity=warning (0.11.0) across all 106 scripts — the only failures are the 3 SC2034 dead variables in devkit_proxmox.STDIN.normalize.to.jsons.sh and proxmox_vm.vm_id.get_usage.to.jsons.sh, i.e. exactly what #118 fixes. This creates a merge-order dependency the PR description didn't have: #118 must merge first (or this branch rebases on it), otherwise this lands a red required check.

[t0kubetsu]

ShellCheck gate resolved (7b969ff..fd0d3de):

• Merged dev in — it added the *_with_api scripts, two of which (proxmox_vm.list_with_api, proxmox_vm.vm_id.list_vm_and_extract_vm_name_with_api) carried a dead ACTION="vm_list" assignment (their jq hardcodes action: "vm_list" instead of passing --arg action "$ACTION" like their siblings). Removed the dead assignments — SC2034, same approach as fix(devkit): remove SC2034 dead variable assignments #118.
• Merged fix(devkit): remove SC2034 dead variable assignments #118's branch (feat/devkit-shellcheck-dead-vars) into this one so the gate can go green without waiting on merge order; git deduplicates when fix(devkit): remove SC2034 dead variable assignments #118 lands on dev.

Verified locally: shellcheck --severity=warning green across the full tree (now 118 scripts after the dev merge).