ci: automated safe autofixes

[github-actions]

Summary

Apply scheduled/manual safe autofixes for scoped Python targets.

What changed

• Ran ruff check --fix on approved Python paths
• Ran black on approved Python paths
• Verified lint and formatting
• Ran targeted pytest where supported

Scope

• apps/aria/
• shared/
• scripts/
• function_app.py

Testing

• Ruff verification
• Black verification
• Targeted pytest (when supported)

Risk & Impact

• Intended to be low risk and non-functional
• Scoped to approved Python paths only
• Review recommended before merge

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/dependabot-auto-merge.yml::dependabot

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/pr-checks.yml::policy-gate

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/dependabot-auto-label.yml::dependabot

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[stepsecurity-app]

Security Policy Alert: Harden Runner Policy Violation

This workflow run has been blocked by StepSecurity's Harden Runner policy.

This workflow run was blocked because one or more jobs are missing the Harden-Runner action, or it is not properly configured, which can introduce agent-bypass risk.

Jobs not protected by Harden Runner:

• .github/workflows/ossar.yml::ossar-scan

Update the affected jobs so Harden Runner is initialized before any other action or command runs.

For more information, see StepSecurity's Harden Runner documentation.

[bryan-roe-bot]

Semgrep found 6 rule findings:

• scripts/setup_env_check.py
  • L355-381 - Triage
• scripts/demo_quantum_llm.py
  • L98-126 - Triage
  • L131-154 - Triage
  • L159-186 - Triage
• scripts/dashboard.py
  • L167-208 - Triage
  • L230-256 - Triage

Semgrep found a match