ci: add trufflehog secrets scan

.agents/.gitignore

@@ -0,0 +1,3 @@
+# Auto-generated by dotagents. Do not edit.
+# Managed skills (installed by dotagents)
+/skills/dotagents/

.coderabbit.yaml

@@ -0,0 +1,8 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+reviews:
+  profile: assertive
+  request_changes_workflow: true
+  auto_review:
+    enabled: true
+    auto_incremental_review: true

.editorconfig

@@ -0,0 +1,23 @@
+# EditorConfig — Phenotype org canonical
+# https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true
+
+[*.{rs,toml,py,go,md,yaml,yml,json,html,css,scss}]
+indent_size = 4
+
+[*.{ts,tsx,js,jsx,mjs,cjs}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab
+
+[*.md]
+trim_trailing_whitespace = false  # trailing spaces = line break in Markdown

.env.example

@@ -0,0 +1,5 @@
+API_BASE_URL=https://api.phenotype.example.com
+DEBUG_ENABLED=false
+NODE_ENV=production
+LOG_LEVEL=info
+

.github/CODEOWNERS

@@ -0,0 +1,10 @@
+# Global code owners for KooshaPari org
+* @KooshaPari
+
+# Infrastructure as code
+/iac/ @KooshaPari
+/.github/ @KooshaPari
+
+# Security-sensitive
+/SECURITY.md @KooshaPari
+/.github/dependabot.yml @KooshaPari

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository
+github: KooshaPari
+custom:
+  - https://www.buymeacoffee.com/kooshapari

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,16 @@
+name: Bug Report
+description: File a report to help us improve Phenotype
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+  - type: textarea
+    id: bug-description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is.
+      placeholder: What happened?
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,11 @@
+name: Feature Request
+description: Suggest an idea for Phenotype
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: feature-description
+    attributes:
+      label: Feature Description
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true

.github/WORKFLOW.md

@@ -0,0 +1,52 @@
+# Workflow Guide
+
+## Repository Configuration
+
+- **origin**: Your fork (push target)
+- **No upstream**: This repo has no upstream source
+
+## Git Settings
+
+```bash
+pull.rebase = false    # Use merge (not rebase)
+pull.ff = only         # Fast-forward only pulls
+merge.ff = false       # Create merge commits
+```
+
+## Worktree Setup
+
+```bash
+# Create feature worktree
+git worktree add worktrees/agentapi/feat/my-feature -b feat/my-feature
+
+# List worktrees
+git worktree list
+
+# Prune stale
+git worktree prune
+```
+
+## Branch Naming
+
+- `feat/*` - Features
+- `fix/*` - Fixes
+- `chore/*` - Maintenance
+- `refactor/*` - Refactoring
+
+## Daily Workflow
+
+```bash
+git worktree add worktrees/agentapi/feat/my-feature -b feat/my-feature
+cd worktrees/agentapi/feat/my-feature
+# ... changes ...
+git add . && git commit -m "feat: my feature"
+git push origin feat/my-feature
+gh pr create --base main --title "feat: my feature"
+```
+
+## Sync Rules
+
+1. Use worktrees for features
+2. No rebase on pushed branches
+3. Merge commits preserve history
+4. Keep branches small and focused

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10

.github/pull_request_template.md

@@ -0,0 +1,30 @@
+## Summary
+
+<!-- Describe what this PR does and why it is needed. -->
+
+## Changes
+
+- 
+
+## Testing
+
+- [ ] Unit tests added/updated
+- [ ] Integration tests added/updated
+- [ ] Manual testing completed
+- [ ] Test coverage maintained or improved
+
+## Validation
+
+- [ ] Lint/format checks passed
+- [ ] Build/test commands documented and successful
+- [ ] Documentation updated (if needed)
+
+## Merge Readiness
+
+- [ ] PR is labeled `automerge` for automatic merge flow (optional)
+- [ ] Conflicts resolved
+
+## Related Issues
+
+Closes: 
+

.github/release-drafter.yml

@@ -0,0 +1,60 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+
+categories:
+  - title: 'Breaking Changes'
+    labels:
+      - 'breaking-change'
+      - 'breaking'
+  - title: 'New Features'
+    labels:
+      - 'feature'
+      - 'enhancement'
+  - title: 'Bug Fixes'
+    labels:
+      - 'fix'
+      - 'bugfix'
+      - 'bug'
+  - title: 'Security'
+    labels:
+      - 'security'
+  - title: 'Documentation'
+    labels:
+      - 'documentation'
+      - 'docs'
+  - title: 'Maintenance'
+    labels:
+      - 'chore'
+      - 'maintenance'
+      - 'dependencies'
+      - 'ci'
+
+change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-title-escapes: '\<*_&'
+
+version-resolver:
+  major:
+    labels:
+      - 'breaking-change'
+      - 'breaking'
+  minor:
+    labels:
+      - 'feature'
+      - 'enhancement'
+  patch:
+    labels:
+      - 'fix'
+      - 'bugfix'
+      - 'bug'
+      - 'security'
+      - 'documentation'
+      - 'chore'
+      - 'maintenance'
+  default: patch
+
+template: |
+  ## Changes
+
+  $CHANGES
+
+  **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION

.github/scripts/security-guard.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+if command -v ggshield >/dev/null 2>&1; then
+  GGSHIELD=(ggshield)
+elif command -v uvx >/dev/null 2>&1; then
+  GGSHIELD=(uvx ggshield)
+elif command -v uv >/dev/null 2>&1; then
+  GGSHIELD=(uv tool run ggshield)
+else
+  echo "ERROR: ggshield not installed. Install with: pipx install ggshield or uv tool install ggshield" >&2
+  exit 1
+fi
+
+echo "[security-guard] Running ggshield secret scan"
+"${GGSHIELD[@]}" secret scan pre-commit
+
+if command -v codespell >/dev/null 2>&1; then
+  changed_files=$(git diff --cached --name-only --diff-filter=ACM || true)
+  if [ -z "${changed_files}" ]; then
+    changed_files=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true)
+  fi
+
+  if [ -n "${changed_files}" ]; then
+    echo "[security-guard] Running optional codespell fast pass"
+    echo "${changed_files}" | \
+      grep -E '\.(md|txt|py|ts|tsx|js|go|rs|kt|java|yaml|yml)$' | \
+      xargs -r codespell -q 2 -L "hte,teh" || true
+  fi
+fi

.github/workflows/alert-sync-issues.yml

@@ -0,0 +1,14 @@
+name: Alert sync issues
+
+permissions:
+  contents: read
+on:
+  schedule:
+    - cron: '17 * * * *'
+  workflow_dispatch:
+
+jobs:
+  sync:
+    uses: KooshaPari/phenoShared/.github/workflows/alert-sync-issues.yml@main
+    with:
+      auto-label: auto-alert-sync

.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - name: Run linters
+        run: echo "Linting..."
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - name: Run tests
+        run: echo "Testing..."

.github/workflows/codeql.yml

@@ -0,0 +1,28 @@
+name: CodeQL
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '27 4 * * 1'
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["go", "javascript-typescript", "python", "actions"]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"