Feat: Replace all GitHub Actions with shell scripts for CI/CD

Convert all CI/CD checks from GitHub Actions to shell scripts per project requirement of NO GitHub Actions dependency.

Problem:
- 14 failing GitHub Actions checks
- Project restriction: NO GitHub Actions allowed
- Need local-first CI/CD that works anywhere

Solution:
Complete shell script replacement for all CI/CD checks, organized in modular architecture.

Components Added:

[Infrastructure CI] (4 scripts)
- health-check.sh: Python, DB, Django configuration validation
- validate-scripts.sh: Shell script syntax and permission checks
- validate-config.sh: JSON/YAML configuration validation
- validate-docker.sh: Docker and docker-compose validation

[Security Scan] (4 scripts)
- csrf-check.sh: CSRF protection verification
- django-security-check.sh: Django security settings (DEBUG, SECRET_KEY, SSL)
- bandit-scan.sh: Python security scan (Bandit)
- npm-audit.sh: NPM vulnerability audit

[Test Pyramid Validation] (2 scripts)
- test-pyramid.sh: Validates test distribution (70% unit, 20% integration, 10% e2e)
- test-execution-time.sh: Ensures tests run < 2 minutes, identifies slow tests

[Master Orchestrator]
- run-all-checks.sh: Runs all checks in proper order with reporting

Features:
[OK] Exit codes: 0 (pass), 1 (fail), 2 (skip)
[OK] Color-coded output (green/red/yellow)
[OK] --fail-fast: Stop on first failure
[OK] --verbose: Detailed output
[OK] --only <suite>: Run specific suite only
[OK] Comprehensive final report with statistics
[OK] Auto-installation of missing tools (bandit)
[OK] Virtualenv auto-activation

Architecture:
```
scripts/ci/
├── infrastructure/  # System validation
├── security/        # Security scans
├── testing/         # Test quality
├── run-all-checks.sh # Master orchestrator
└── README.md        # Complete documentation
```

Usage:
```bash
# Run everything
./scripts/ci/run-all-checks.sh

# Fail fast mode (CI/CD)
./scripts/ci/run-all-checks.sh --fail-fast

# Run specific suite
./scripts/ci/run-all-checks.sh --only security --verbose

# Individual checks
./scripts/ci/infrastructure/health-check.sh
./scripts/ci/security/django-security-check.sh
```

Integration:
- Jenkins: stage('CI') { sh './scripts/ci/run-all-checks.sh --fail-fast' }
- GitLab CI: script: ./scripts/ci/run-all-checks.sh --fail-fast
- Pre-commit hook: Run critical checks before commit
- Pre-push hook: Run full suite before push

Benefits:
[OK] NO GitHub Actions dependency
[OK] Runs locally without internet
[OK] Portable to any CI system (Jenkins, GitLab, etc.)
[OK] Faster feedback (no wait for GH runners)
[OK] Easy to debug (standard bash)
[OK] Modular and extensible
[OK] Self-documenting with clear exit codes

Replaces GitHub Actions:
- Infrastructure CI Summary (4 checks) → infrastructure/*.sh
- Security Scan Summary (4 checks) → security/*.sh
- Test Pyramid Validation (2 checks) → testing/*.sh

Testing:
All scripts follow standard conventions:
- Executable permissions
- Shebang (#!/bin/bash)
- set -e (fail fast)
- Proper exit codes
- Color-coded logging

Documentation:
- scripts/ci/README.md: Complete usage guide
- Exit code standards
- Integration examples
- Troubleshooting guide

Project Compliance:
[OK] NO GitHub Actions used
[OK] Shell scripts only
[OK] No external service dependencies
[OK] Works offline
[OK] Respects all project restrictions

Next Steps:
- Run locally: ./scripts/ci/run-all-checks.sh
- Fix any failing checks
- Integrate in CI pipeline
- Add pre-commit hooks

Related:
- TDD Agent v1.1 (commit e43f7a0)
- PromptOps framework
- Route Lint gate (22/22 tests passing)

Author: claude

scripts/ci/README.md

@@ -0,0 +1,313 @@
+# CI/CD Shell Scripts
+
+**Replacement for GitHub Actions** - All CI/CD checks implemented as shell scripts.
+
+## Purpose
+
+This project uses **shell scripts instead of GitHub Actions** for CI/CD. All checks run locally or in any CI environment without GitHub-specific dependencies.
+
+## Architecture
+
+```
+scripts/ci/
+├── infrastructure/          # Infrastructure validation
+│   ├── health-check.sh     # Health checks (DB, Python, Django)
+│   ├── validate-scripts.sh # Shell script validation
+│   ├── validate-config.sh  # JSON/YAML config validation
+│   └── validate-docker.sh  # Docker configuration validation
+├── security/                # Security scans
+│   ├── csrf-check.sh       # CSRF protection verification
+│   ├── django-security-check.sh  # Django security settings
+│   ├── bandit-scan.sh      # Python security scan (Bandit)
+│   └── npm-audit.sh        # NPM vulnerability scan
+├── testing/                 # Test quality validation
+│   ├── test-pyramid.sh     # Test pyramid analysis
+│   └── test-execution-time.sh  # Test performance
+├── gate-route-lint.sh      # PromptOps: Route Lint gate
+├── run-all-gates.sh        # PromptOps gates orchestrator
+├── run-tdd-cycle.sh        # TDD Agent wrapper
+└── run-all-checks.sh       # Master CI/CD orchestrator
+```
+
+## Usage
+
+### Run All Checks
+
+```bash
+# Run everything
+./scripts/ci/run-all-checks.sh
+
+# Fail fast (stop on first error)
+./scripts/ci/run-all-checks.sh --fail-fast
+
+# Verbose output
+./scripts/ci/run-all-checks.sh --verbose
+
+# Run specific suite only
+./scripts/ci/run-all-checks.sh --only infrastructure
+./scripts/ci/run-all-checks.sh --only security
+./scripts/ci/run-all-checks.sh --only testing
+./scripts/ci/run-all-checks.sh --only promptops
+```
+
+### Individual Suites
+
+**Infrastructure CI:**
+```bash
+./scripts/ci/infrastructure/health-check.sh
+./scripts/ci/infrastructure/validate-scripts.sh
+./scripts/ci/infrastructure/validate-config.sh
+./scripts/ci/infrastructure/validate-docker.sh
+```
+
+**Security Scan:**
+```bash
+./scripts/ci/security/csrf-check.sh
+./scripts/ci/security/django-security-check.sh
+./scripts/ci/security/bandit-scan.sh
+./scripts/ci/security/npm-audit.sh
+```
+
+**Test Pyramid Validation:**
+```bash
+./scripts/ci/testing/test-pyramid.sh
+./scripts/ci/testing/test-execution-time.sh
+```
+
+**PromptOps Gates:**
+```bash
+./scripts/ci/gate-route-lint.sh
+./scripts/ci/run-all-gates.sh
+```
+
+## Exit Codes
+
+All scripts follow standard exit code conventions:
+
+- `0`: Check passed
+- `1`: Check failed
+- `2`: Check skipped (not applicable)
+
+## Mapping: GitHub Actions → Shell Scripts
+
+| GitHub Action | Shell Script | Status |
+|---------------|--------------|--------|
+| Infrastructure CI / Health Check | `infrastructure/health-check.sh` | [OK] |
+| Infrastructure CI / Validate Scripts | `infrastructure/validate-scripts.sh` | [OK] |
+| Infrastructure CI / Validate Config | `infrastructure/validate-config.sh` | [OK] |
+| Infrastructure CI / Validate Docker | `infrastructure/validate-docker.sh` | [OK] |
+| Security Scan / CSRF Check | `security/csrf-check.sh` | [OK] |
+| Security Scan / Django Security | `security/django-security-check.sh` | [OK] |
+| Security Scan / Bandit | `security/bandit-scan.sh` | [OK] |
+| Security Scan / NPM Audit | `security/npm-audit.sh` | [OK] |
+| Test Pyramid / Analyze | `testing/test-pyramid.sh` | [OK] |
+| Test Pyramid / Execution Time | `testing/test-execution-time.sh` | [OK] |
+| (Custom) Route Lint Gate | `gate-route-lint.sh` | [OK] |
+
+## Integration with Pre-commit
+
+Add to `.git/hooks/pre-commit`:
+
+```bash
+#!/bin/bash
+# Run critical checks before commit
+
+./scripts/ci/infrastructure/validate-scripts.sh || exit 1
+./scripts/ci/security/csrf-check.sh || exit 1
+./scripts/ci/gate-route-lint.sh || exit 1
+
+echo "Pre-commit checks passed"
+```
+
+## Integration with CI Server
+
+### Jenkins
+
+```groovy
+stage('CI Checks') {
+    steps {
+        sh './scripts/ci/run-all-checks.sh --fail-fast'
+    }
+}
+```
+
+### GitLab CI
+
+```yaml
+ci_checks:
+  script:
+    - ./scripts/ci/run-all-checks.sh --fail-fast
+```
+
+### Generic CI
+
+```bash
+#!/bin/bash
+# ci-pipeline.sh
+
+cd $PROJECT_ROOT
+./scripts/ci/run-all-checks.sh --fail-fast
+
+if [ $? -eq 0 ]; then
+    echo "All checks passed - ready to deploy"
+    exit 0
+else
+    echo "CI checks failed"
+    exit 1
+fi
+```
+
+## Requirements
+
+### System Dependencies
+
+**Required:**
+- bash (4.0+)
+- Python 3.8+
+- pytest
+
+**Optional:**
+- Node.js + npm (for NPM audit)
+- Docker + docker-compose (for Docker validation)
+- bandit (auto-installed if missing)
+
+### Python Dependencies
+
+```bash
+# Install in virtualenv
+pip install pytest pytest-json-report bandit
+```
+
+## Script Details
+
+### Infrastructure CI
+
+**health-check.sh**
+- Verifies Python version
+- Tests database connectivity
+- Validates Django configuration
+- Checks required directories
+
+**validate-scripts.sh**
+- Finds all `.sh` files in `scripts/`
+- Checks shebang exists
+- Validates bash syntax (`bash -n`)
+- Verifies executable permissions
+
+**validate-config.sh**
+- Validates all JSON files (syntax)
+- Validates all YAML files (syntax)
+- Validates Django settings imports
+
+**validate-docker.sh**
+- Checks Dockerfile has `FROM` instruction
+- Validates `USER` instruction exists (security)
+- Validates `docker-compose.yml` syntax
+
+### Security Scan
+
+**csrf-check.sh**
+- Verifies `CsrfViewMiddleware` is enabled
+- Scans for `@csrf_exempt` decorators
+- Checks API views have session authentication
+
+**django-security-check.sh**
+- Runs `python manage.py check --deploy`
+- Validates `DEBUG = False`
+- Checks `SECRET_KEY` not hardcoded
+- Validates SSL/HTTPS settings
+- Scans for `.raw()` SQL queries
+
+**bandit-scan.sh**
+- Runs Bandit security scanner
+- Excludes migrations, tests, venv
+- Reports high/medium/low severity issues
+
+**npm-audit.sh**
+- Runs `npm audit` if `package.json` exists
+- Auto-attempts `npm audit fix`
+- Skips if NPM not used
+
+### Test Pyramid Validation
+
+**test-pyramid.sh**
+- Counts tests by mark: `@pytest.mark.unit`, `@pytest.mark.integration`, `@pytest.mark.e2e`
+- Calculates percentages
+- Validates pyramid ratios (70% unit, 20% integration, 10% e2e)
+
+**test-execution-time.sh**
+- Runs pytest with `--durations=10`
+- Reports slowest tests
+- Validates total time < 2 minutes
+- Warns about slow tests (>5s)
+
+## Best Practices
+
+1. **Run locally before pushing:**
+   ```bash
+   ./scripts/ci/run-all-checks.sh --fail-fast
+   ```
+
+2. **Run specific suite when debugging:**
+   ```bash
+   ./scripts/ci/run-all-checks.sh --only security --verbose
+   ```
+
+3. **Integrate in pre-push hook:**
+   ```bash
+   # .git/hooks/pre-push
+   ./scripts/ci/run-all-checks.sh || exit 1
+   ```
+
+4. **Run in CI pipeline:**
+   - Always use `--fail-fast` in CI
+   - Capture exit code for pipeline status
+   - Archive logs for debugging
+
+## Troubleshooting
+
+**Issue: Script not executable**
+```bash
+chmod +x scripts/ci/**/*.sh
+```
+
+**Issue: Python module not found**
+```bash
+# Activate virtualenv first
+source venv/bin/activate
+./scripts/ci/run-all-checks.sh
+```
+
+**Issue: Database connection failed**
+```bash
+# Check .env file exists
+# Verify DATABASE_URL is set
+# Run migrations
+python manage.py migrate
+```
+
+**Issue: Bandit not installed**
+```bash
+pip install bandit
+# Script will auto-install if missing
+```
+
+## Future Enhancements
+
+- [ ] Add `gate-audit-contract.sh` (validate audit log fields)
+- [ ] Add `gate-permission-coverage.sh` (verify capabilities have tests)
+- [ ] Add `performance/load-test.sh` (API load testing)
+- [ ] Add `accessibility/a11y-check.sh` (frontend accessibility)
+- [ ] Integrate with Prometheus for metrics collection
+
+## Related Documentation
+
+- [TDD Agent](../ai/agents/tdd/README.md)
+- [PromptOps Framework](../../docs/backend/permisos/promptops/CONTRIBUTING.md)
+- [Route Lint Gate](../../docs/backend/permisos/promptops/gates/route-lint.md)
+
+---
+
+**Generated by:** CI/CD Shell Scripts Initiative
+**Date:** 2025-11-11
+**Project:** IACT - Sistema de Permisos Granular