feat: Enhance CI/CD with mypy, Python 3.13, coverage, and docs workflow

- Add Python 3.13 to test matrix (now 3.10-3.13 × 3 OS = 12 jobs)
- Add mypy type checking to lint job (non-blocking)
- Add Codecov coverage upload on Ubuntu/3.11
- Add docs.yml workflow for MkDocs build and deploy
- Add PR labeler for automatic labeling based on file changes
- Add Dependabot for automated dependency updates (pip, actions, docker)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: silversurfer562

.github/dependabot.yml

@@ -0,0 +1,54 @@
+# Dependabot configuration
+# See: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates
+
+version: 2
+updates:
+  # Python dependencies
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        patterns:
+          - "pytest*"
+          - "black"
+          - "ruff"
+          - "mypy"
+          - "coverage"
+          - "bandit"
+          - "pre-commit"
+      llm-providers:
+        patterns:
+          - "anthropic"
+          - "openai"
+      web-frameworks:
+        patterns:
+          - "fastapi"
+          - "uvicorn"
+          - "starlette"
+    labels:
+      - "dependencies"
+      - "python"
+
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 3
+    labels:
+      - "dependencies"
+      - "ci"
+
+  # Docker (Dev Container)
+  - package-ecosystem: "docker"
+    directory: "/.devcontainer"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "devcontainer"

.github/labeler.yml

@@ -0,0 +1,61 @@
+# Label configuration for actions/labeler
+# See: https://github.com/actions/labeler
+
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'docs/**/*'
+          - '*.md'
+          - 'mkdocs.yml'
+
+tests:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'tests/**/*'
+
+core:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'src/empathy_os/**/*'
+          - 'empathy_llm_toolkit/**/*'
+
+plugins:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'empathy_software_plugin/**/*'
+          - 'empathy_healthcare_plugin/**/*'
+
+wizards:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'coach_wizards/**/*'
+          - 'wizards/**/*'
+
+cli:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'src/empathy_os/cli*.py'
+          - 'empathy_llm_toolkit/cli/**/*'
+
+ci:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '.github/**/*'
+
+dependencies:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'pyproject.toml'
+          - 'requirements*.txt'
+
+security:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'empathy_llm_toolkit/security/**/*'
+          - '.bandit'
+          - '.github/workflows/security.yml'
+
+devcontainer:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '.devcontainer/**/*'

.github/workflows/docs.yml

@@ -0,0 +1,66 @@
+name: Documentation
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'mkdocs.yml'
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[docs]
+
+      - name: Build documentation
+        run: mkdocs build --strict
+
+      - name: Upload docs artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: documentation
+          path: site/
+
+  deploy:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+          cache: 'pip'
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .[docs]
+
+      - name: Deploy to GitHub Pages
+        run: mkdocs gh-deploy --force

.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+name: PR Labeler
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/tests.yml

@@ -14,7 +14,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: ['3.10', '3.11', '3.12']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
     - uses: actions/checkout@v4
@@ -30,12 +30,22 @@ jobs:
         python -m pip install --upgrade pip
         pip install -e .[dev]
 
-    - name: Run tests
+    - name: Run tests with coverage
       run: |
-        pytest
+        pytest --cov-report=xml
       env:
         ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
 
+    - name: Upload coverage to Codecov
+      if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11'
+      uses: codecov/codecov-action@v4
+      with:
+        files: ./coverage.xml
+        fail_ci_if_error: false
+        verbose: true
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
   lint:
     runs-on: ubuntu-latest
     steps:
@@ -50,14 +60,19 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install black ruff bandit[toml]
+        pip install black ruff bandit[toml] mypy
 
     - name: Check formatting with Black
       run: black --check .
 
     - name: Lint with Ruff
       run: ruff check .
 
+    - name: Type check with MyPy
+      run: |
+        mypy src/empathy_os empathy_llm_toolkit --ignore-missing-imports --no-error-summary || true
+      continue-on-error: true  # Non-blocking for now
+
     - name: Security scan with Bandit
       run: bandit -c .bandit -r src/ empathy_llm_toolkit/ coach_wizards/ empathy_software_plugin/ --severity-level medium --confidence-level medium