feat(security): complete P5-T4 Security Monitoring CI Pipeline

[2witstudios]

Implement comprehensive security testing CI pipeline:

• Add pnpm test:security script for running all security tests locally
• Create scripts/test-security.sh to run 51+ security test files
• Enhance .github/workflows/security.yml with:
  • Core security module tests (rate limiting, path validation, SSRF)
  • Authentication module tests (tokens, sessions, CSRF)
  • Multi-tenant isolation and permission tests
  • Web app auth route and library tests
  • Database transaction security tests (race conditions)
  • Processor security tests
  • CodeQL security analysis with security-extended queries
  • Daily scheduled security runs at 6:00 UTC
  • Security summary job aggregating all results
• Update plan.md to mark P5-T4 as complete

Phase 5 progress: 2/5 tasks complete (P5-T4, P5-T5)

Summary by CodeRabbit

Release Notes

• Chores
  • Expanded CI/CD security testing infrastructure with broader coverage, CodeQL analysis integration, automated secret scanning, and scheduled security sweeps.
  • Added security test suite script for comprehensive local testing across multiple security domains.
  • Updated project roadmap tracking security monitoring initiatives.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes expand the security testing and monitoring infrastructure by introducing a comprehensive CI/CD security workflow with additional test matrices, database migration steps, environment configuration, CodeQL analysis, and a security aggregation job. A new test orchestration script is added alongside updated project planning to track security monitoring tasks and an npm script entry.

Changes

Cohort / File(s)	Summary
CI/CD Security Workflow Expansion .github/workflows/security.yml	Extends security workflow triggers (push, pull_request, workflow_dispatch, schedule). Adds broader path monitoring for security packages and tests. Expands test matrix with 11 new security-focused test runs (core security, auth modules, multi-tenant isolation, permissions, web app auth, security headers, database transactions). Introduces database migration step, environment variable setup for test databases and Redis. Adds CodeQL security analysis job and security-summary job that aggregates results and enforces critical failure conditions. Updates action versions to v4 and refines secret scanning logic.
Test Orchestration & Scripts scripts/test-security.sh	New Bash script implementing a Security Test Suite Runner. Defines colored output helpers, progress tracking, and a run_test_suite() function. Orchestrates 11 test suites across Core Security, Authentication, Authorization, Web App Auth, Google OAuth, Security Headers, MCP WebSocket, Processor, and Database Transaction domains. Aggregates results and reports pass/fail counts with exit code signaling.
Configuration & Planning package.json, plan.md	Adds test:security npm script and trailing comma to changelog:generate. Updates Phase 5 planning to "In Progress" status with completed tasks (Security Monitoring CI Pipeline, Legacy JWT Deprecation) and new remaining tasks (Audit Log Schema, Audit Service, Anomaly Detection). Replaces skeleton with concrete CI-driven workflow details and enhanced acceptance criteria.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 Security workflows flow like streams so bright,
🔐 New test suites guard through day and night,
📋 Audit logs and CodeQL scans take flight,
🛡️ The rabbit scripts orchestrate with delight,
✨ Each phase hops forward, strong and tight!

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main objective of the pull request—completing the P5-T4 Security Monitoring CI Pipeline task with comprehensive workflow enhancements, new test scripts, and plan updates.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.