feat(core): v0.5.0 - rule evaluations, scan hardening, AI foundations, enterprise rules, and OWASP migration

.dockerignore

@@ -1,8 +1,11 @@
 .git
+.gitdata
 .github
 .pytest_cache
 .ruff_cache
 .venv
+.lock-tools
+.test-venv
 venv
 **/.venv
 **/venv

.env.example

@@ -4,6 +4,11 @@ DATABASE_URL=postgresql://openshield:openshield@localhost:5432/openshield
 # Auth
 JWT_SECRET=change-me-in-production
 
+# Optional - comma-separated subscription_id allowlist for POST /api/scans/trigger.
+# Unset accepts any subscription_id (matches historical behavior); the API
+# logs a startup warning when this is unset. See docs/api-reference.md.
+OPENSHIELD_AUTHORIZED_SUBSCRIPTIONS=
+
 # AI providers - add at least one
 ANTHROPIC_API_KEY=
 GROQ_API_KEY=
@@ -12,3 +17,7 @@ GEMINI_API_KEY=
 # Optional
 NVD_API_KEY=
 SENTRY_DSN=
+
+# Optional - enables AZ-SC-007/008 (Azure DevOps pipeline scanning)
+AZURE_DEVOPS_ORG_URL=
+AZURE_DEVOPS_PROJECT=

.github/ISSUE_TEMPLATE/new_rule.md

@@ -8,7 +8,7 @@ assignees: ''
 
 ## Rule Details
 - Rule ID: AZ-XXX-000
-- Severity: HIGH / MEDIUM / LOW
+- Severity: CRITICAL / HIGH / MEDIUM / LOW / INFO
 - Category: Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes / PostQuantum
 - Frameworks: CIS / NIST / ISO 27001 / SOC 2
 

.github/PULL_REQUEST_TEMPLATE.md

@@ -12,7 +12,7 @@
 
 ## Rule details (if applicable)
 - Rule ID: AZ-XXX-000
-- Severity: HIGH / MEDIUM / LOW
+- Severity: CRITICAL / HIGH / MEDIUM / LOW / INFO
 - Category: Storage / Network / Identity / Database / Compute / Key Vault / Kubernetes
 - Frameworks mapped: CIS / NIST / ISO 27001 / SOC 2
 
@@ -26,6 +26,7 @@
 Closes #
 
 ## Checklist
+- [ ] Every commit includes a DCO `Signed-off-by` trailer (`git commit -s`; see `docs/dco.md`)
 - [ ] My code follows the rule template in CONTRIBUTING.md
 - [ ] I added or updated the matching CLI playbook
 - [ ] I added or updated all four compliance framework mappings