feat: complete enterprise security model audit hardening #20

	name: CI

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false

	- name: Markdown lint
	uses: avto-dev/markdown-lint@04687db2e9b72c18a4dfce687923a8daa3e4b543 # v1
	with:
	args: 'docs/*/.md README.md CONTRIBUTING.md SECURITY.md'

	- name: Link check
	uses: lycheeverse/lychee-action@2b973e86fc7b1f6b36a93795fe2c9c6ae1118621 # v1
	with:
	args: '--verbose --no-progress docs/*/.md README.md'
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Verify Mermaid blocks
	run: grep -rl '```mermaid' docs README.md

	- name: Validate JSON formatting
	run: \|
	find impl -name '*.json' -print0 \|
	xargs -0 -n1 jq empty

	- name: Install Bicep CLI
	run: az bicep install

	- name: Validate repository contracts
	run: bash scripts/validate-repository.sh

Provide feedback