ci: pin actions, add scanners and stats card, restore required checks

[trsdn]

Part 2 of 3 of the Repository Quality Standard 1.18.1 rollout (pipeline).

• S12: pin the outside actions that run in jobs with a secret or write access (11 references) to commit SHAs with a version comment.
• S11: declare permissions on test.yml and security.yml (this also clears eight actions/missing-workflow-permissions code scanning alerts).
• S05/R09/P13: add the shared secret scan and the shared CodeQL workflow (languages actions, python). CodeQL default setup is not-configured, so the repository's own workflow is the scanner, per the CodeQL guide.
• P09: add the stats caller (card on the stats branch, because main is protected). The README card follows in the record pull request, once the first run has produced it.
• P08: README badges reordered to the convention; the CI badge pointed at a workflow named CI that does not exist, so it now points at ci-gates.yml; licence and Python badges are derived instead of typed.
• Restore the required checks: Integration Smoke Tests and Quick Security Scan were defined only in fast-tests.yml, manual-only since [Feature]: Simplify CI checks and consolidate required gates #58, so pull requests waited on them forever. They are now jobs of ci-gates.yml; this pull request is the first to report them.

Verified locally: ruff format --check ., ruff check ., smoke tests (7 passed) and bandit --severity-level high all pass. The workflow changes are verified by this pull request's own run.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CdiwBVuH6DCEtFPPwxbXKc

[github-actions]

🔍 PR Analysis Results

PR: #64 | Commit: 6145589892265416c786d9cd7d22b4ad5fe60416

🎨 Code Formatting

✅ All files properly formatted

🔧 Code Linting

✅ No linting issues found

📝 Type Checking

❌ Type checking issues found

Click to see type issues

usage: mypy [-h] [-v] [-V] [more options; see below]
            [-m MODULE] [-p PACKAGE] [-c PROGRAM_TEXT] [files ...]
mypy: error: unrecognized arguments: --json-report mypy_report.json

Fix: Add proper type annotations and resolve type errors

🔒 Security Analysis

✅ No security issues detected

📊 Test Coverage Analysis

✅ Coverage 81.81818181818181% meets 80% requirement

🧹 Dead Code Analysis

✅ Dead code analysis completed

📋 Summary

⚠️ Found 1 issue(s) that should be addressed:

• 📝 Types: Issues found

🔧 Quick Fix Commands:

# Fix formatting and auto-fixable linting issues
ruff format .
ruff check . --fix

# Run tests with coverage
pytest tests/unit/ --cov=markitdown_mcp --cov-report=term-missing

# Check security
bandit -r markitdown_mcp/

---

This analysis was automatically generated by the PR feedback workflow.
Report generated at 2026-09-21 19:38:03 UTC

[github-actions]

🔍 CI Quality Gates Summary

Overall Status: ✅ All Passed

Check	Status	Details	Action Required
🎨 Format	✅ Passed	ruff format check	None
🔧 Lint	✅ Passed	ruff linting	None
📝 Types	✅ Passed	mypy type checking	None
🧪 Tests	✅ Passed	Unit tests	None
📊 Coverage	81.8%	Minimum: 80%	None
🔌 MCP	✅ Valid	Protocol compliance	None
🔒 Security	✅ Clean	Dependency audit	None

🔗 Quick Links

• View detailed analysis
• See workflow logs

🛠️ Quick Fix Commands

# Fix most issues automatically
ruff format .
ruff check . --fix

# Run tests locally
pytest tests/unit/ --cov=markitdown_mcp

# Check types
mypy markitdown_mcp

---

Last updated: 2026-09-21 19:38:18 UTC

[github-actions]

🔍 PR Quality Summary

CI Status

⚪ Tests: pending
✅ Docs: success
✅ Security: success
✅ Quality: success

Metrics

Metric	Value	Trend
📊 Coverage	N/A	-
🧪 Tests	Test results unavailable	-
⏱️ Performance	No performance data	-

Quality Checks

• Format & Lint: Ruff formatting and linting
• Type Safety: MyPy strict type checking
• Security: Bandit, Safety, GitLeaks scanning
• MCP Protocol: Tool schema validation
• Documentation: Docstring coverage (80%+)

MCP Tools

• convert_file - Convert individual files to Markdown
• convert_directory - Batch convert directories
• list_supported_formats - Query supported file types

---

_{🤖 Auto-generated by CI • Last updated: 2026-09-21 19:39 UTC}