[lucaosti]

What

• .github/workflows/ci.yml:
  • Triggers: pull_request (any base branch, so stacked PRs are checked too) and push to main.
  • Concurrency cancels runs that have been superseded.
  • Jobs:
    • lint
    • typecheck
    • import-contracts
    • test, which writes a coverage summary
    • quality-gate, which runs with if: always() and fails when any required job failed, was cancelled or was skipped
• .github/dependabot.yml:
  • Ecosystems uv and github-actions.
  • Weekly on Mondays, Europe/Rome.
  • Minor and patch updates grouped; major updates as separate PRs.
  • The npm entry for services/qvac-worker comes with E3.

Why

M0-3 of the backlog. The single gate is what M0-6 (#7) will mark as the only required check on main.

Closes #4

How verified

• Both files validate against the GitHub workflow and Dependabot JSON schemas (check-jsonschema).
• On this PR, all five jobs run and must be green. See the checks below.
• I opened a throwaway draft PR with a deliberate ruff violation to confirm that quality-gate fails. The result is linked in a comment below.

Reviewer notes

• Stacked on chore(ci): configure ruff, mypy, pytest coverage and import-linter #46, which is stacked on feat(engine): scaffold the uv workspace with engine and code-rag packages #45. Merge them in order: feat(engine): scaffold the uv workspace with engine and code-rag packages #45, then chore(ci): configure ruff, mypy, pytest coverage and import-linter #46, then this PR.
• The action versions are major tags (actions/checkout@v5, astral-sh/setup-uv@v6). Dependabot keeps them current.

[lucaosti]

Gate verification:

• This PR: all five jobs pass (run).
• Throwaway test(ci): throwaway - quality gate must fail on a ruff violation #48 added an unused import. lint failed and quality-gate failed, while the other jobs passed (run). test(ci): throwaway - quality gate must fail on a ruff violation #48 is closed without merging.

[lucaosti]

Merged without an approving review by maintainer decision, to unblock contributors: this is the foundation chain everything else depends on. Verified locally on the combined chain (#1, #45, #46, #47, #49, #50 merged together, no conflicts): uv sync --locked, ruff check and format, mypy, import-linter (3 contracts kept), pytest with 100% coverage.