ci: parity cleanup with the engine baseline

[rennf93]

Aligns djapi-guard with the guard-core/fastapi-guard baseline. Two small alignments plus the workflow set the other adapters already carry:

• Adds the issue-link.yml workflow (verbatim from fastapi-guard) so PRs must reference an open issue or carry the no-issue label.
• Adds the || 'test_token' fork fallback to IPINFO_TOKEN in ci.yml, matching the guard-core convention from 4d3c35e4 (fork PRs have no access to the repo secret, so the bare reference fails on forks), and wires --cov-fail-under=100 (verified locally: 278 tests, 100% statement and branch coverage).
• Adds the docksec.yml, live-smoke.yml, and upstream-drift.yml workflows matching the adapter set (docksec verbatim from fastapi-guard).
• The example app is fixed to use the guard request/response protocol (query_params, DjangoGuardResponse, guard-response header mutation) and enables behavior_scan_response_body; compose.yml quotes the REDIS_PREFIX value.

Summary by CodeRabbit

• New Features
  • New CI workflows added: DockSec Dockerfile scanning, a dockerized live smoke test of the example app, and a daily upstream drift test against guard-core master.
• Improvements
  • Pull request checks verify that closing references point to open issues in the repository. Checks report missing or invalid references; bot-authored pull requests and those labeled no-issue are exempt.
  • CI tests use a test token when the IP information service token is unset or empty, and now require full coverage.
  • The example app enables response-body behavior scanning and uses the guard request/response protocol correctly.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 88d86858-5038-4078-92e2-ee5e3c3cc034

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thanks for opening your first pull request on djangoapi-guard!

Quick checklist before review (most of these are enforced by CI, but worth a glance):

• make lint — ruff format, ruff check, mypy, and vulture
• make test (or make local-test) — full test suite passes with 100% coverage
• make security — bandit, safety, and pip-audit all clean
• make quality — radon and xenon complexity thresholds respected
• No # noqa / # type: ignore shortcuts; pre-existing violations in touched files are fixed
• Added an entry under ## Unreleased in CHANGELOG.md
• If you touched a public API, updated the relevant page under docs/
• If the change involves engine logic, the corresponding fix landed in guard-core first

See CONTRIBUTING.md for the full workflow and the Code of Conduct for the community standards we follow.

Welcome aboard — a maintainer will review shortly.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.