Motivation

• Strengthen CI quality gates by running a Python 3.9–3.12 matrix with linting, format checks, type checks, security scans, coverage-enforced tests, smoke verification, and package build validation.
• Improve security posture by scheduling CodeQL and adding dependency/vulnerability/secret scanning pipelines.
• Provide small production-oriented reference implementations (thread-safe nonce registry and SQLite audit storage) to exercise CI, observability, and integration testing.

Description

• Expanded .github/workflows/ci.yml to a multi-version Python matrix (3.9–3.12) and added steps for ruff lint/format checks, mypy over kernels and implementations, bandit security scan, coverage-enforced pytest, smoke script execution, and package build verification via python -m build.
• Added .github/workflows/security.yml enhancements for scheduled CodeQL, dependency review, vulnerability scans (safety, pip-audit), and a gitleaks secret-scanning job, and adjusted .github/workflows/release.yml to include workflow_dispatch and twine check verification.
• Added a new smoke workflow .github/workflows/smoke.yml for on-demand/manual/PR smoke runs that executes ./scripts/smoke.sh.
• Introduced reference implementations: implementations/permits_threadsafe.py (TTL-aware, thread-safe nonce registry with stats()) and implementations/storage.py (SQLite-backed audit storage with append(), list_entries(), and health()).
• Added targeted tests at tests/test_reference_implementations.py to validate concurrency, max-execution enforcement, TTL cleanup, SQLite persistence, and health diagnostics, and extended scripts/smoke.sh to exercise these implementations and set PYTHONPATH for local runs.
• Developer experience updates: updated Makefile with new targets (format-check, dep-scan, smoke, build), lowered requires-python to >=3.9 in pyproject.toml, and added changelog entries describing the changes.

Testing

• Ran ruff check implementations/permits_threadsafe.py implementations/storage.py tests/test_reference_implementations.py and the checks passed for the modified files.
• Applied ruff format and then verified with ruff format --check for the same files (formatting applied where needed and check passed).
• Ran mypy implementations/permits_threadsafe.py implementations/storage.py --follow-imports=skip and it reported no issues for the new implementations.
• Executed pytest tests/test_reference_implementations.py -q and all tests passed (4 passed).
• Executed the smoke script ./scripts/smoke.sh locally and it completed successfully exercising examples, the nonce registry, and SQLite storage.
• Note: attempts to install and run the full set of external scanners and build tools (bandit, safety, pip-audit, build, twine) in this execution environment were blocked by package/index/proxy restrictions, so full repo-wide CI gates (lint across the whole repo, full mypy kernels, and coverage enforcement with pytest-cov) are configured in workflows but could not be fully validated here.

Codex Task