fix(ci): emit bare Security Gate Validation context

.github/workflows/security-analysis.yml

@@ -46,3 +46,34 @@ jobs:
       run-safety: false  # safety removed from deps; pip-audit covers vulnerability scanning
       run-osv: true
       no-build: false  # project uses hatchling build backend; uv must build the editable install
+
+  # `security` is a workflow_call caller job (has uses:), so it can only ever
+  # emit the context "Security Analysis / Security Gate Validation" (the
+  # reusable workflow's own inner gate job name, prefixed with this caller
+  # job's name). It can never emit the bare "Security Gate Validation"
+  # context that org ruleset ByronWilliamsCPA-default-branch-baseline
+  # requires. This normal job (has steps:, no uses:) closes that gap by
+  # re-emitting the bare context, gated on the reusable call's own result.
+  security-gate-validation:
+    name: Security Gate Validation
+    runs-on: ubuntu-latest
+    needs: [security]
+    if: always()
+    permissions:
+      contents: read
+    steps:
+      - name: Harden the runner (Audit outbound calls)
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Check security scan results
+        env:
+          SECURITY_RESULT: ${{ needs.security.result }}
+        run: |
+          if [ "$SECURITY_RESULT" = "success" ] || [ "$SECURITY_RESULT" = "skipped" ]; then
+            echo "Security gate passed"
+          else
+            echo "Security gate FAILED: $SECURITY_RESULT"
+            exit 1
+          fi

CHANGELOG.md

@@ -19,6 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - fix(api): guard `content-length` header parsing against malformed values; `int()` conversion is now wrapped in a `ValueError` handler so a non-numeric header no longer raises an unhandled exception
 - fix(tests): restore `tmp_path` fixture in `test_custom_initialization` for `AudioConverter`, `AudioConditioner`, and `VADProcessor`; hardcoded `/custom/temp` caused `PermissionError` on systems without root access
 - fix(core): harden the shared job store. `RedisJobStore._decode_hash` now converts a corrupt or legacy (non-JSON) field value into a typed, logged `DatabaseError` instead of letting a raw `JSONDecodeError` propagate and 500 a `GET` route or wedge the worker decode loop. `InMemoryJobStore.get`/`update`/`create` deep-copy records so callers cannot mutate stored state out of band (including nested `progress`/`input`/`result` dicts), matching `RedisJobStore`. `RedisJobStore` now rejects a non-positive `ttl_seconds` with `ConfigurationError` rather than letting Redis `EXPIRE` delete newly written jobs immediately
+- fix(ci): the required `Security Gate Validation` check never reported on pull requests; `security-analysis.yml`'s only job (`security`) calls the org-level `python-security-analysis.yml` reusable workflow via `uses:`, and a reusable-workflow-caller job can only ever emit a `<caller job name> / <inner job name>` context, never the bare inner job name. The check therefore always reported as `Security Analysis / Security Gate Validation`, which never matches the bare context the `ByronWilliamsCPA-default-branch-baseline` org ruleset requires, so it sat "Expected" forever. Added a normal job (`security-gate-validation`, `name: Security Gate Validation`) that re-emits the bare context based on the reusable call's own result
 
 ### Fixed
 

src/audio_processor/api/__init__.py

@@ -147,9 +147,14 @@ async def global_exception_handler(request: Request, exc: Exception) -> JSONResp
     Returns:
         JSONResponse: JSON response with generic error message.
     """
-    # Log the exception with full context for debugging and monitoring
-    logger.exception(
+    # Log the exception with full context for debugging and monitoring.
+    # This handler runs outside a lexical `except` block (FastAPI calls it
+    # with the exception instance rather than re-raising into one), so
+    # logger.exception()'s implicit sys.exc_info() lookup is not reliable
+    # here; pass the exception explicitly via exc_info instead.
+    logger.error(
         "unhandled_exception",
+        exc_info=exc,
         exc_type=type(exc).__name__,
         exc_message=str(exc),
         path=str(request.url.path),

src/audio_processor/api/routes.py

@@ -87,7 +87,7 @@
     Returns:
         JobStore: The active job store.
     """
     store = getattr(request.app.state, "job_store", None)
     if isinstance(store, JobStore):
         return store
     return _default_store
@@ -133,7 +133,7 @@
     """
     if not settings.enqueue_enabled:
         return
     pool = getattr(request.app.state, "arq_pool", None)
     if pool is None:
         # Enqueueing is enabled but no pool is configured: the job would be
         # stranded QUEUED forever. Fail loudly rather than silently accept it.
@@ -146,7 +146,7 @@
     # unless enqueueing is actually used.
     from audio_processor.jobs.worker import enqueue_task  # noqa: PLC0415
 
     await enqueue_task(pool, "process_audio_job", job_id, record)
 
 
 # Upload streaming chunk size (1 MiB).
@@ -200,6 +200,7 @@
 )
 async def process_audio(
     request: Request,
+    *,
     file: Annotated[UploadFile, File(description="Audio or video file to process")],
     enable_diarization: Annotated[
         bool,
@@ -429,8 +430,8 @@
         progress_data = job["progress"]
         if isinstance(progress_data, dict):
             progress = AudioJobProgress(
                 stage=str(progress_data.get("stage", "unknown")),
                 percent_complete=int(progress_data.get("percent_complete", 0)),
                 message=str(progress_data.get("message", "")),
                 started_at=progress_data.get("started_at"),  # type: ignore[arg-type]
                 updated_at=datetime.now(UTC),

src/audio_processor/core/exceptions.py

@@ -41,7 +41,7 @@
     # Allows nesting for complex error contexts
     ErrorDetails = dict[
         str,
-        str | int | float | bool | None | dict[str, str | int | float | bool | None],
+        str | int | float | bool | dict[str, str | int | float | bool | None] | None,
     ]
 else:
     ErrorDetails = dict

src/audio_processor/core/sentry.py

@@ -43,6 +43,7 @@
 
 
 def init_sentry(
+    *,
     dsn: str | None = None,
     environment: str | None = None,
     release: str | None = None,

src/audio_processor/services/vad_processor.py

@@ -11,6 +11,7 @@
 import tempfile
 from dataclasses import dataclass
 from pathlib import Path
+from typing import cast
 
 import librosa
 import numpy as np
@@ -282,8 +283,12 @@ def process_audio(
         )
 
         try:
-            # Load audio
+            # Load audio. dtype="float64" guarantees a float64 array at
+            # runtime; soundfile's stub returns a dtype union for the
+            # non-literal dtype argument, so cast to the concrete alias
+            # used by speech_chunks below.
             audio, sample_rate = sf.read(str(input_path), dtype="float64")
+            audio = cast("AudioSamples", audio)
 
             # Ensure mono
             if audio.ndim > 1: