docs(ci): explain workflow triggers and merge gates

[dumbdevss]

Document all six workflows, their path filters, jobs, local equivalents, and actual advisory status. Clarify that Security Scans is manual-only and distinguish workflow soft-fail behavior from branch-protection requirements.

Closes #1655

Validation: docs review; git diff --check; verified all six linked workflow files exist

Security Changes

Type of Security Change

• SAST rule update
• Dependency vulnerability fix
• Exemption addition/renewal
• Security workflow modification
• Container image update
• Other: _______________

Vulnerability Details (if applicable)

CVE/Advisory ID:

• CVE-ID:
• GHSA-ID:

Affected Package:

• Name:
• Version:
• Severity: [ ] Critical [ ] High [ ] Medium [ ] Low

Fix Applied:

• Package version bump
• Code change to mitigate
• Configuration update
• Exemption granted (see below)

Exemption Request (if applicable)

Exemption ID: EXEMPT-___

Justification:

Mitigation Applied:

Expiry Date: YYYY-MM-DD (max 90 days from now)

Review Plan:

Testing

• Ran npm audit locally - output attached or no new vulnerabilities
• Security workflow passes on this branch
• Test suite passes: npm test
• Build succeeds: npm run build

Security Impact Analysis

Affected Components:

• Authentication/Authorization
• Payment processing
• Data encryption
• API endpoints
• Dependencies
• Container images
• CI/CD pipeline
• Other: _______________

Risk Assessment:

Documentation Updates

• Updated README.md (if workflow changed)
• Updated SECURITY-CI-SETUP.md (if process changed)
• Updated security-exemptions.json (if applicable)
• Added security notes to code comments

Checklist

• No secrets or keys committed
• No PII or sensitive data in logs
• All security scans pass (or exemptions documented)
• Branch protection requirements met
• Code review from security team (for critical changes)

Additional Notes

Test Output

# Paste npm test output here
npm test

# Paste npm audit output here (if relevant)
npm audit

CI Run Link

Workflow Run:

---

Security Review Required: @security-team
Compliance Impact: [Yes/No - explain if yes]

[drips-wave]

@dumbdevss Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits