refactor(ci): optimize CI pipeline structure

Changes:
1. Add independent 'security' job
   - Move govulncheck from test to security
   - Move Trivy scan from docker-build to security
   - Depends on lint + test, non-blocking for main pipeline

2. Test coverage as warning only
   - Add 'continue-on-error: true'
   - Use ::warning:: annotation for GitHub UI
   - No longer fails CI if below threshold

3. Update summary job dependencies
   - Add security to needs list
   - Security failures show warning but don't block CI

Benefits:
- Security checks run independently
- Coverage warnings don't block deployments
- Better separation of concerns (lint/test/security/build)

Related: Story 5 CI/CD Pipeline, Story 17 Go Version Upgrade

Author: chendelin1982

.github/workflows/ci.yml

@@ -50,27 +50,23 @@ jobs:
         working-directory: core
         run: go mod download
 
-      - name: Run govulncheck (dependency vulnerability scan)
-        uses: golang/govulncheck-action@v1
-        with:
-          go-version-input: ${{ env.GO_VERSION }}
-          go-package: ./...
-          work-dir: core
-
       - name: Run tests with coverage
         working-directory: core
         run: |
           go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
           go tool cover -func=coverage.out
           
-      - name: Check coverage threshold
+      - name: Check coverage threshold (warning only)
         working-directory: core
+        continue-on-error: true
         run: |
           COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
-          echo "Current coverage: ${COVERAGE}%"
+          echo "📊 Current coverage: ${COVERAGE}%"
           if (( $(echo "$COVERAGE < ${{ env.COVERAGE_THRESHOLD }}" | bc -l) )); then
-            echo "Coverage ${COVERAGE}% is below threshold ${{ env.COVERAGE_THRESHOLD }}%"
-            exit 1
+            echo "⚠️  Warning: Coverage ${COVERAGE}% is below threshold ${{ env.COVERAGE_THRESHOLD }}%"
+            echo "::warning::Code coverage (${COVERAGE}%) is below the recommended threshold (${{ env.COVERAGE_THRESHOLD }}%)"
+          else
+            echo "✅ Coverage meets threshold"
           fi
 
       - name: Upload coverage to Codecov
@@ -106,48 +102,87 @@ jobs:
         run: |
           ./bin/apprun-core --version || echo "Version command not implemented yet"
 
-  docker-build:
-    name: Build Docker Image
+  security:
+    name: Security Checks
     runs-on: ubuntu-latest
     needs: [lint, test]
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache: true
+          cache-dependency-path: core/go.sum
+
+      - name: Run govulncheck (dependency vulnerabilities)
+        uses: golang/govulncheck-action@v1
+        with:
+          go-version-input: ${{ env.GO_VERSION }}
+          go-package: ./...
+          work-dir: core
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Build Docker image (test only)
-        id: build
+      - name: Build Docker image for security scan
         uses: docker/build-push-action@v5
         with:
           context: .
           file: ./docker/Dockerfile
           push: false
-          tags: apprun:ci-test
+          tags: apprun:security-scan
           cache-from: type=gha
           cache-to: type=gha,mode=max
-          platforms: linux/amd64,linux/arm64
+          load: true
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@master
         with:
           scan-type: 'image'
-          image-ref: 'apprun:ci-test'
+          image-ref: 'apprun:security-scan'
           format: 'sarif'
           output: 'trivy-results.sarif'
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
 
-      - name: Upload Trivy scan results to GitHub Security tab
+      - name: Upload Trivy results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
 
+  docker-build:
+    name: Build Docker Image
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build Docker image (test only)
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./docker/Dockerfile
+          push: false
+          tags: apprun:ci-test
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64,linux/arm64
+
   integration-test:
     name: Integration Tests
     runs-on: ubuntu-latest
@@ -174,25 +209,36 @@ jobs:
   summary:
     name: CI Summary
     runs-on: ubuntu-latest
-    needs: [lint, test, build, docker-build, integration-test]
+    needs: [lint, test, build, security, docker-build, integration-test]
     if: always()
+    permissions:
+      actions: write
     steps:
       - name: Check job status
         run: |
           echo "=== CI Pipeline Summary ==="
           echo "Lint: ${{ needs.lint.result }}"
           echo "Test: ${{ needs.test.result }}"
           echo "Build: ${{ needs.build.result }}"
+          echo "Security: ${{ needs.security.result }}"
           echo "Docker Build: ${{ needs.docker-build.result }}"
           echo "Integration Test: ${{ needs.integration-test.result }}"
           
+          # Core jobs must pass (security is independent)
           if [[ "${{ needs.lint.result }}" != "success" ]] || \
              [[ "${{ needs.test.result }}" != "success" ]] || \
              [[ "${{ needs.build.result }}" != "success" ]] || \
              [[ "${{ needs.docker-build.result }}" != "success" ]]; then
             echo "❌ CI Pipeline failed"
             exit 1
           fi
+          
+          # Security check warning (non-blocking)
+          if [[ "${{ needs.security.result }}" != "success" ]]; then
+            echo "⚠️  Security checks failed - please review vulnerabilities"
+            echo "::warning::Security scan detected vulnerabilities. Check the Security tab for details."
+          fi
+          
           echo "✅ CI Pipeline passed"
           echo ""
           echo "Note: Docker Build workflow will be triggered automatically via workflow_run on main/develop branches"