chore(ci): add CI workflow and Dependabot hardening

[t0kubetsu]

Summary

• ruff + pytest on python:3.13-slim + pip/github-actions Dependabot

Closes #80

Changes

• .github/workflows/ci.yml — CI pipeline running in a containerised Debian/Python/Node image
• .github/dependabot.yml — automated dependency updates

Test plan

• CI runs green on this PR
• Dependabot alerts enabled in repo settings

[pparage]

Review — approve with comments

CI workflow, .ansible-lint and Dependabot for the bundles repo. This is the best-formed of the four sibling ci-hardening PRs: the Python job is guarded behind test -f pyproject.toml, so it correctly no-ops today (no pyproject.toml, no r42playbooks/, no tests/ on dev) and switches on by itself when the package lands. The mock_roles list and the extra_vars stub for global_vm_ssh_name are the right way to let cross-repo roles resolve without checking out the catalog.

Blocking

• none

Non-blocking

• .github/workflows/ci.yml:15,24 — ansible-lint and the -e ".[dev]" install are unpinned, so a lint release can turn this red with no change to the repo. Worth pinning ansible-lint==x.y.z.
• .github/workflows/ci.yml:33 — ruff check --select ALL r42playbooks/. Same caveat as range42#214, where that exact flag currently yields 943 errors: --select ALL enables every opinionated family and is not recommended upstream. Dormant here until a pyproject.toml exists, so it costs nothing today — but it will land loudly on whoever adds one. A ruff config committed alongside it would avoid that.
• mock_roles is a hand-maintained list of 17 role names. When a bundle starts using a new catalog role, CI fails with a resolution error rather than anything meaningful. Not worth restructuring, but a one-line comment saying "add new catalog roles here" would save the next person the diagnosis.

Cross-repo

• The mock_roles entries mirror role names owned by range42-catalog (software.install.wazuh-*, systems.configure.add_user, software.configure.docker-compose, …). This file becomes a second place those names are written down, so a catalog role rename now breaks CI here as well as breaking deploys. That is a net positive — it turns a silent runtime break into a loud CI one — but it belongs on the rename checklist.
• One of four siblings (range42#214, range42-catalog#183, this, devkit#116). No merge ordering between them.

Verification

• ansible-lint bundles/ — not run; not installed in this environment and the routine does not install system-wide. The config was reviewed by reading only, so I cannot tell you whether the gate is green.
• Confirmed the Python job's guard is correct: pyproject.toml, r42playbooks/ and tests/ are all absent on dev, so those three steps are skipped.
• Secrets pass on the diff — clean.
• Staleness: opened 2026-06-09, no commits in ~2 months. Still applies — the repo has no CI workflow on dev today.

---

Generated by Claude Code

[t0kubetsu]

@pparage comments addressed — pushed 90d37d8..3ac2d68:

Pins: ansible-lint==26.6.0 pinned. (The -e .[dev] install stays unpinned by design — it's guarded behind pyproject.toml, which is where those pins will live when the package lands.)

ruff: --select ALL dropped in favor of a committed .ruff.toml selecting E9,F — same baseline as range42#214, so whoever adds pyproject.toml inherits a defined, green gate instead of a loud landing.

mock_roles: now carries a maintenance note (hand-maintained; add new catalog roles here; belongs on the catalog rename checklist).

Verification — you flagged you couldn't run the lint, and that caution was justified: ansible-lint bundles/ with 26.6.0 was red on the PR head — 34 fatals (14 yaml[indentation], 13 schema[playbook] from null vars:, 4 yaml[truthy], 3 key-order[task]). Fixed in 8811eb2 with behavior-preserving normalization only (vars: → vars: {}, when: above block:, empty play name: keys removed, indentation). Gate now exits 0 (0 failures, 21 warnings, basic profile satisfied). .ansible/ (ansible-lint's mock-role cache) added to .gitignore.

[t0kubetsu]

Conflict with dev resolved (3ac2d68..eaf5271). Two things had happened under the branch:

1. The restructure: bundles/core/proxmox/configure/default/vms/create-vms-* moved to scenarios/blank_scenario_2_subnets/ on dev, colliding with the lint-normalization commit. Resolution: took dev's side everywhere (its versions already dropped the null vars: blocks), so the normalization commit's surviving diff shrinks to the files still under bundles/.
2. New unlinted trees: dev added bundles/admin, bundles/generic and bundles/ctf — 108 fresh gate failures. Fixed: style violations via ansible-lint --fix (colons, quoting, key-order — style-only, verified by diff), five new catalog roles added to mock_roles, runtime group vars (target_group, TARGET_GROUP, wazuh_clients_group, kunai wrappers) stubbed in extra_vars, and RANGE42_BUNDLE_DIR set on the lint step since repo.clone.kunai_workshop resolves its inner import_playbook path from that env var.

ansible-lint bundles/ on the merged tree: exit 0 — 0 failures, 1 warning (a yaml[line-length] in template.build.ubuntu_noble). PR is mergeable again.