feat: implement /opt/fournos/entrypoint contract for FORGE engine

.claude/settings.json

@@ -0,0 +1,36 @@
+{
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path' | { read -r f; [[ \"$f\" == *.py ]] && { ruff format . || echo \"Warning: ruff format failed for $f\"; }; } || echo \"Warning: file path processing failed\"",
+            "statusMessage": "Formatting Python code with ruff..."
+          },
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path' | { read -r f; [[ \"$f\" == *.py ]] && { ruff check --fix . || echo \"Warning: ruff check --fix failed for $f\"; }; } || echo \"Warning: file path processing failed\"",
+            "statusMessage": "Fixing Python linting issues with ruff..."
+          }
+        ]
+      },
+      {
+        "matcher": "Edit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path' | { read -r f; [[ \"$f\" == *.py ]] && { ruff format . || echo \"Warning: ruff format failed for $f\"; }; } || echo \"Warning: file path processing failed\"",
+            "statusMessage": "Formatting Python code with ruff..."
+          },
+          {
+            "type": "command",
+            "command": "jq -r '.tool_input.file_path' | { read -r f; [[ \"$f\" == *.py ]] && { ruff check --fix . || echo \"Warning: ruff check --fix failed for $f\"; }; } || echo \"Warning: file path processing failed\"",
+            "statusMessage": "Fixing Python linting issues with ruff..."
+          }
+        ]
+      }
+    ]
+  }
+}

.github/steps/prepare_minimal_ubuntu_image/action.yml

@@ -1,9 +1,10 @@
 name: "Prepare FORGE minimal ubuntu image"
+description: "Install minimal Python dependencies required for FORGE repository operations"
 
 runs:
   using: "composite" # <-- this is the important part
   steps:
   - name: Install dependencies
     shell: bash
     run: |
-      python3 -m pip install fire pyyaml jsonpath_ng joblib
+      python3 -m pip install pyyaml jsonpath_ng

.github/workflows/check_consistency.yml

@@ -18,11 +18,28 @@ jobs:
       PYTHONPATH: ${{ github.workspace }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: ./.github/steps/prepare_minimal_ubuntu_image
 
-      - name: Check that no symlink is broken
-        run: bin/run_ansible_toolbox.py repo validate_no_broken_link
+      - name: Check that all source files end with EOL
+        run: |
+          # Find all source files and check they end with newline
+          files_without_eol=()
+
+          while IFS= read -r -d '' file; do
+            if [[ -s "$file" ]] && [[ -n "$(tail -c1 "$file")" ]]; then
+              files_without_eol+=("$file")
+            fi
+          done < <(find . -path './.git' -prune -o \( -name "*.py" -o -name "*.yml" -o -name "*.yaml" -o -name "*.json" -o -name "*.md" \) -type f -print0)
+
+          if [[ ${#files_without_eol[@]} -gt 0 ]]; then
+            echo "❌ Files missing final newline:"
+            printf '%s\n' "${files_without_eol[@]}"
+            echo "Fix with: echo >> filename"
+            exit 1
+          fi
+          echo "✅ All source files end with newline"

.github/workflows/check_python_syntax.yml

@@ -10,9 +10,10 @@ jobs:
       max-parallel: 4
     steps:
       - name: Use checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check that all the files can be compiled
         run: |

.github/workflows/image-push.yaml

@@ -10,7 +10,9 @@ jobs:
   image-push:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Remove GitHub credentials from git config
         run: |

.github/workflows/ruff.yaml

@@ -16,7 +16,9 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5

.github/workflows/test_toolbox_dsl.yml

@@ -20,7 +20,9 @@ jobs:
       PYTHONPATH: ${{ github.workspace }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v5
         with:

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.11.8
+    rev: v0.16.0
     hooks:
       - id: ruff
         args: [--fix]