fix(ci): add gate jobs and consolidate linting workflow (#1182)

* fix(ci): standardize workflow naming and remove redundant workflows

- Rename CI job names to consistent format:
  - test-python ({version}, {os})
  - test-frontend ({os})
  - test-integration ({os})

- Remove redundant workflows:
  - test-on-tag.yml: Tests already run via CI before tag creation
  - validate-version.yml: Should be part of prepare-release
  - test-azure-auth.yml: Dead trigger (manual only)
  - pr-status-gate.yml: Redundant with branch protection rules

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(ci): remove status labels and update docs for deleted workflows

- Remove STATUS labels from pr-labeler.yml (redundant with GitHub's
  native PR checks UI)
- Remove stale comments referencing deleted pr-status-gate.yml
- Update CONTRIBUTING.md to remove 'Test on Tag' workflow reference
- Update RELEASE.md to remove validate-version.yml reference

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(ci): remove review labels from pr-labeler

Review labels (Missing AC Approval, AC: Approved, etc.) are removed
since pr-status-gate.yml was deleted and GitHub's native review
system already handles approval state and invalidation on new commits.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(ci): add gate jobs and consolidate linting workflow

- Add CI Complete gate job to ci.yml for simplified branch protection
- Add TypeScript (ESLint) linting to lint.yml alongside Python (Ruff)
- Add Lint Complete gate job to lint.yml
- Remove redundant lint step from test-frontend (now in lint.yml)

Branch protection now only needs 3 checks:
- CI Complete (all tests/builds)
- Lint Complete (Python + TypeScript)
- Security Summary (CodeQL + Bandit)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Test User <test@example.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -131,10 +131,6 @@ jobs:
         working-directory: apps/frontend
         run: npm ci --ignore-scripts
 
-      - name: Run linter
-        working-directory: apps/frontend
-        run: npm run lint
-
       - name: Run TypeScript type check
         working-directory: apps/frontend
         run: npm run typecheck
@@ -196,3 +192,29 @@ jobs:
             source .venv/bin/activate
           fi
           pytest ../../tests/test_platform.py -v --tb=short
+
+  # --------------------------------------------------------------------------
+  # Gate Job - Single check for branch protection
+  # --------------------------------------------------------------------------
+  ci-complete:
+    name: CI Complete
+    runs-on: ubuntu-latest
+    needs: [test-python, test-frontend, test-platform-integration]
+    if: always()
+    steps:
+      - name: Check all CI jobs passed
+        run: |
+          echo "CI Job Results:"
+          echo "  test-python:               ${{ needs.test-python.result }}"
+          echo "  test-frontend:             ${{ needs.test-frontend.result }}"
+          echo "  test-platform-integration: ${{ needs.test-platform-integration.result }}"
+          echo ""
+
+          if [[ "${{ needs.test-python.result }}" != "success" ]] || \
+             [[ "${{ needs.test-frontend.result }}" != "success" ]] || \
+             [[ "${{ needs.test-platform-integration.result }}" != "success" ]]; then
+            echo "❌ One or more CI jobs failed"
+            exit 1
+          fi
+
+          echo "✅ All CI checks passed"

.github/workflows/lint.yml

@@ -11,8 +11,9 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Python linting
+  # Python linting (Ruff)
   python:
+    name: Python (Ruff)
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -32,3 +33,53 @@ jobs:
 
       - name: Run ruff format check
         run: ruff format apps/backend/ --check --diff
+
+  # TypeScript/JavaScript linting (ESLint)
+  typescript:
+    name: TypeScript (ESLint)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+
+      - name: Get npm cache directory
+        id: npm-cache
+        run: echo "dir=$(npm config get cache)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache npm dependencies
+        uses: actions/cache@v4
+        with:
+          path: ${{ steps.npm-cache.outputs.dir }}
+          key: ${{ runner.os }}-npm-lint-${{ hashFiles('apps/frontend/package-lock.json') }}
+          restore-keys: ${{ runner.os }}-npm-lint-
+
+      - name: Install dependencies
+        working-directory: apps/frontend
+        run: npm ci --ignore-scripts
+
+      - name: Run ESLint
+        working-directory: apps/frontend
+        run: npm run lint
+
+  # Gate job for branch protection
+  lint-complete:
+    name: Lint Complete
+    runs-on: ubuntu-latest
+    needs: [python, typescript]
+    if: always()
+    steps:
+      - name: Check lint results
+        run: |
+          if [[ "${{ needs.python.result }}" != "success" ]] || \
+             [[ "${{ needs.typescript.result }}" != "success" ]]; then
+            echo "❌ Linting failed"
+            echo "  Python:     ${{ needs.python.result }}"
+            echo "  TypeScript: ${{ needs.typescript.result }}"
+            exit 1
+          fi
+          echo "✅ All linting passed"