ci: split linters into independent parallel jobs and add CI documentation

Refactors .github/workflows/tests.yaml so that flake8, black, mypy,
pylint, and bandit each run as their own job in parallel with the test
job. This ensures a failure in one tool never blocks the others, and
contributors see full feedback from every tool on every CI run.

- Upgrades actions/checkout to v4 and actions/setup-python to v5
- All linter jobs are enforced (no continue-on-error)
- Test artifacts (junit.xml, coverage.xml) always uploaded
- Bandit JSON report always uploaded as artifact
- Adds docs/CIWorkflow.md with maintainer documentation
- Updates CONTRIBUTING.md with CI workflow table and link

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/tests.yaml

@@ -3,7 +3,9 @@ name: Run Tests & Linting
 on: [push, pull_request]
 
 jobs:
+  # ── Tests ──────────────────────────────────────────────────────────────
   test:
+    name: Tests
     runs-on: ubuntu-latest
     services:
       redis:
@@ -27,10 +29,10 @@ jobs:
           --health-retries 5
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.11"
 
@@ -46,6 +48,7 @@ jobs:
         run: pytest tests/ -v --cov=app --cov-report=xml --cov-report=term --junitxml=junit.xml -o junit_family=legacy -m "not e2e"
 
       - name: Upload coverage reports to Codecov
+        if: ${{ !cancelled() }}
         uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -58,37 +61,127 @@ jobs:
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
-      - name: Run Linter (Flake8)
-        run: flake8 app/ --max-line-length=120 --extend-ignore=E203,W503
-        continue-on-error: false
-
-      - name: Run Code Formatter (Black)
-        run: black --check app/ --line-length=120
-        continue-on-error: false
-
-      - name: Run Type Checker (Mypy)
-        run: mypy app/ --ignore-missing-imports
-        continue-on-error: true
-
-      - name: Run Linter (Pylint)
-        run: pylint app/ --max-line-length=120 --disable=C0111,C0103,R0903
-        continue-on-error: true
-      
-      - name: Run Security Linter (Bandit) - Full Report
-        run: |
-          echo "Running Bandit security scan..."
-          bandit -r app/ -f json -o bandit-report.json || true
-        continue-on-error: true
-      
-      - name: Run Security Linter (Bandit) - Fail on High/Medium
-        run: |
-          echo "Running Bandit security scan (fail on high/medium severity)..."
-          bandit -r app/ -ll
-        continue-on-error: false
-      
-      - name: Upload Bandit Report
+      - name: Upload test artifacts
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results
+          path: |
+            junit.xml
+            coverage.xml
+
+  # ── Flake8 ─────────────────────────────────────────────────────────────
+  flake8:
+    name: Flake8
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install flake8
+
+      - name: Run Flake8
+        run: flake8 app/ --max-line-length=120 --extend-ignore=E203,W503
+
+  # ── Black ──────────────────────────────────────────────────────────────
+  black:
+    name: Black
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install black
+
+      - name: Run Black
+        run: black --check app/ --line-length=120
+
+  # ── Mypy ───────────────────────────────────────────────────────────────
+  mypy:
+    name: Mypy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run Mypy
+        run: mypy app/ --ignore-missing-imports
+
+  # ── Pylint ─────────────────────────────────────────────────────────────
+  pylint:
+    name: Pylint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run Pylint
+        run: pylint app/ --max-line-length=120 --disable=C0111,C0103,R0903
+
+  # ── Bandit ─────────────────────────────────────────────────────────────
+  bandit:
+    name: Bandit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install Dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install bandit
+
+      - name: Run Bandit - Full Report
+        if: ${{ !cancelled() }}
+        run: bandit -r app/ -f json -o bandit-report.json || true
+
+      - name: Run Bandit - Fail on High/Medium
+        run: bandit -r app/ -ll
+
+      - name: Upload Bandit Report
+        if: ${{ !cancelled() }}
         uses: actions/upload-artifact@v4
-        if: always()
         with:
           name: bandit-report
           path: bandit-report.json