ci: add weekly antigravity code audit workflow

[gspencergoog]

Summary

This PR replaces the legacy Cloud Run compliance audit implementation with automated GitHub Actions workflows for scheduled weekly codebase audits and interactive ChatOps-driven remediation.

Changes

• Weekly Audit Workflow (.github/workflows/weekly-audit.yml, .github/scripts/run_weekly_audit.py):
  • Adds a scheduled GitHub Actions workflow that runs every Tuesday at 14:00 UTC (and via workflow_dispatch).
  • Executes run_weekly_audit.py to trigger the remote Antigravity Agent API (a2ui-audit skill) against a2ui-project/a2ui.
  • Extracts the full audit report text from the agent response and automatically opens a structured GitHub compliance issue when audit items are found.
• ChatOps Remediation Workflow (.github/workflows/remediate_chatops.yml, .github/scripts/run_remediation.py):
  • Adds an interactive workflow triggered by issue comments containing /remediate on A2UI Compliance Report issues.
  • Verifies commenter collaborator permissions before running run_remediation.py.
  • Invokes the a2ui-audit skill using the remediation playbook to automatically generate a draft pull request addressing the reported issue.
• Remediation Playbook & Reporting Helpers (.agents/skills/a2ui-audit/references/remediate-problem.md, .agents/skills/a2ui-audit/scripts/create_compliance_report.py):
  • Adds remediate-problem.md to guide the remediation agent through branch creation, code fixes, and draft pull request submission.
  • Adds create_compliance_report.py to format compliance audit findings into standard markdown reports.
  • Updates skill instructions in blueprints/skills/a2ui-blueprint-compliance/SKILL.md to reference the permanent repository script path.
• Security & Linting Compliance:
  • Pins all GitHub Action commit SHAs to pass zizmor security audits.
  • Formats Python scripts with pyink and YAML configuration with Prettier.
  • Adds Apache 2.0 license headers across all new scripts and workflows.

Impact & Risks

• No breaking changes to existing repository code or runtime packages.
• The scheduled workflow consumes GitHub Actions runner minutes once per week.
• The ChatOps workflow requires collaborator write permissions and depends on the remote Antigravity Agent API service availability.

Testing

• Added unit test suites for all Python scripts:
  • .github/scripts/tests/test_run_weekly_audit.py: Tests environment validation, mock SDK polling loops, and report extraction.
  • .github/scripts/tests/test_run_remediation.py: Tests ChatOps comment parsing, permission checks, and draft pull request creation.
  • .agents/skills/a2ui-audit/scripts/test_create_compliance_report.py: Tests markdown formatting for compliance reports.
• Hooked .github/scripts/** path triggers into .github/workflows/python_ci.yml so script unit tests run on pull request presubmit.
• Step-by-step verification for reviewers:
  1. Run the script unit tests locally: python3 -m unittest discover -s .github/scripts/tests and python3 -m unittest discover -s .agents/skills/a2ui-audit/scripts.
  2. Verify code formatting by running pyink --check . and YAML formatting with Prettier.
  3. Inspect the Actions tab on a test branch to confirm weekly-audit.yml and remediate_chatops.yml pass zizmor security checks.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.