feat(metricsai): initial package + CI

[bhodges-navapbc]

Summary

Introduces metricsai, a concise Python package + CLI that gathers AI-in-SDLC metrics from pluggable modules and posts a single weekly row (week_ending_date + one field per metric) to a Google Sheets–backed webhook.

• src-layout package with a module registry — all registered modules run by default; --module NAME (repeatable) narrows scope.
• security module (live): scans AI-reviewer PR comments via PyGithub (issue comments, inline review comments, review submissions; filtered by author, week window, and Conventional-Comment label) and counts FAILED CRITICAL/HIGH AWS Security Hub findings via boto3 — emitting all security_* and security_compliance_* columns. Ports of the example shell scripts.
• build_pr and testing modules: stubbed placeholders emitting their columns.
• Secrets: macOS keychain for the GitHub token and webhook key (env-overridable; non-interactive runs fail fast instead of prompting).
• GitHub Enterprise support (--github-url), fine-grained least-privilege PAT instructions, and srt/boto3 sandbox notes.

CI

• New path-scoped GitHub Actions workflow (metricsai CI) runs ruff format --check, ruff check, and pytest via uv, triggered only on changes to metricsai/** (or the workflow itself).

Config / CLI highlights

--repo, --author, --github-url, --week-ending, --tab, --url, --dry-run, --set-token, --set-webhook-key, -v/--debug; METRICSAI_* env vars for all of the above.

Testing

• uv run pytest — all passing.
• ruff check / ruff format --check / black --check — clean.
• uv run mkdocs build — succeeds.
• CLI verified: --list-modules, stub dry-run, all-modules default, clear errors when repos/key are missing.

Notes

• The webhook always returns HTTP 200 ({ok: bool} body) and 302-redirects a POST to a googleusercontent URL, so the client follows redirects and treats the body — not the status code — as the result; auth is a body key (_key), not a header.
• Defaults chosen (easily changed): Thursday-ending week (7-day inclusive UTC window, Fri 00:00:00Z–Thu 23:59:59Z), single-region Security Hub via boto3's default credential chain.

🤖 Generated with Claude Code