security: implement critical Week 1 security fixes and CI/CD pipeline

[Z0shua]

Week 1 & 2 Security Fixes and Code Quality Improvements

This PR addresses critical security issues and implements comprehensive code quality improvements identified in the codebase review.

🔒 Week 1: Critical Security Fixes

1. SQL Injection Prevention

• File: src/omcp_py/tools/query_tools.py
• Removed unsafe where parameter entirely
• All WHERE conditions now use safe parameterized queries via filters parameter
• Eliminates raw SQL injection vulnerability

2. Race Condition - Sandbox Max Check

• File: src/omcp_py/sandbox_manager.py
• Moved sandbox limit check inside lock after container creation (double-check pattern)
• Prevents concurrent requests from bypassing sandbox limits
• Ensures thread-safe resource management

3. Enhanced Code Validator

• File: src/omcp_py/security/code_validator.py
• Added 20+ blocked imports (threading, asyncio, multiprocessing, etc.)
• Enhanced blocked built-ins from 5 to 13 functions
• New blocked attributes list (16 dangerous attributes)
• Comprehensive AST checks for dynamic execution bypasses

4. Credentials & Logging Security

• File: src/omcp_py/core/db.py
• Masked credentials in logs (displays *** instead of passwords)
• Disabled SQL echo by default
• Fixed deprecated datetime.utcnow() → datetime.now(timezone.utc)
• Added connection pooling and context manager
• File: src/omcp_py/sandbox_manager.py - Added 10-second Docker timeout

5. CI/CD Pipeline

• Added comprehensive GitHub Actions workflow (.github/workflows/test.yml)
• Tests on Python 3.9-3.12 with PostgreSQL 15
• Security scanning: bandit, pip-audit, detect-secrets
• Coverage tracking to Codecov

---

🧪 Week 2: Code Quality & Testing

1. Comprehensive Unit Tests (70+ test cases)

• File: tests/test_code_validator.py
• Test Coverage:
  • 18 tests for import blocking
  • 15 tests for dangerous built-ins (exec, eval, getattr, etc.)
  • 9 tests for attribute access bypasses
  • 6 tests for subscript access tricks
  • 7 tests for sandbox escape patterns
  • 7 tests for edge cases (syntax errors, multiline strings, etc.)
  • 5 tests for real-world examples (pandas, numpy, file operations)
  • 4 tests for validator instance/configuration

Test Results: All 70+ tests verified to pass ✅

2. Fixed Bare Exception Blocks

• File: src/omcp_py/tools/query_tools.py
• Replaced bare except Exception with specific exception types
• Now catches (duckdb.Error, OSError, RuntimeError, ValueError)
• Better error handling, debugging, and exception specificity

3. Version Pinning - All Dependencies

• File: pyproject.toml
• All production dependencies now have version constraints:
  • mcp[cli]>=1.6.0,<2.0.0
  • docker>=7.0.0,<8.0.0
  • SQLAlchemy>=2.0,<3.0
  • pandas>=1.5.0,<3.0.0
  • duckdb>=0.8.0,<2.0.0
  • And all other core dependencies
• Dev dependencies now include:
  • pytest-cov>=5.0.0 - coverage reporting
  • mypy>=1.10.0 - type checking
  • bandit>=1.7.0 - security scanning
  • pip-audit>=2.6.0 - dependency vulnerability scanning

4. Comprehensive Pytest Configuration

• File: pyproject.toml
• Configured test discovery and strict mode
• Added coverage reporting settings
• Configured markers for integration/slow tests
• Set up warning filters

5. Type Checking Configuration

• File: pyproject.toml
• Added mypy configuration
• Enabled check_untyped_defs and strict_equality
• Python 3.10+ target

---

📊 Combined Impact

Metric	Before	After
SQL Injection Risk	High	✅ Eliminated
Sandbox Escapes	10+ bypass vectors	✅ Blocked
Race Conditions	1 critical	✅ Fixed
Credential Exposure	Logged in full	✅ Redacted
Code Validator Tests	0 tests	✅ 70+ tests
Bare Exceptions	6+ instances	✅ Fixed
Dependency Pinning	0% pinned	✅ 100% pinned
Pytest Config	None	✅ Comprehensive
Type Checking Config	None	✅ Configured
Security Scanning	Manual	✅ Automated

---

📦 Changes Summary

Files Modified:

• .github/workflows/test.yml (114 lines) - CI/CD pipeline
• src/omcp_py/tools/query_tools.py - SQL injection + bare exceptions
• src/omcp_py/sandbox_manager.py - Race condition + Docker timeout
• src/omcp_py/security/code_validator.py - Enhanced validation
• src/omcp_py/core/db.py - Credentials + pooling + datetime
• pyproject.toml - Dependencies, pytest, mypy config

Files Added:

• tests/test_code_validator.py (514 lines) - 70+ test cases

---

✅ Testing

All changes verified:

• ✅ Python syntax compilation successful
• ✅ Code validator tests pass (70+ tests)
• ✅ Manual validator tests passed
• ✅ Git workflows push successful

---

🔄 Next Steps (Week 3-4)

Performance & Scalability (Week 3):

• Add docstrings to 15+ functions
• Convert sync Docker/DB calls to async with run_in_executor()
• Cache compose network detection
• Docker timeout configuration

DevOps & Documentation (Week 4):

• Improve Dockerfile (multi-stage, official uv, healthcheck)
• Move hardcoded passwords to .env
• Expand security.md documentation
• Dependabot configuration