docs(07-06): complete CI/CD documentation plan

.planning/phases/07-import-cicd/07-06-SUMMARY.md

@@ -0,0 +1,94 @@
+---
+phase: 07-import-cicd
+plan: 06
+subsystem: docs
+tags: [docs, ci-cd, github-actions, sarif, pre-commit]
+requires:
+  - 07-04
+  - 07-05
+provides:
+  - docs/CI-CD.md
+  - README.md#ci-cd-integration
+affects:
+  - user-onboarding
+tech-stack:
+  added: []
+  patterns:
+    - "Documentation-by-example: copy-paste GitHub Actions workflow"
+    - "Cross-linked README section -> deep-dive doc"
+key-files:
+  created:
+    - docs/CI-CD.md
+  modified:
+    - README.md
+decisions:
+  - "Expanded existing README CI/CD stub in-place rather than appending a new section, to preserve the established Quick Start flow"
+  - "Documented continue-on-error: true explicitly in the Actions example so users understand why exit-1-with-SARIF-upload is the desired shape"
+  - "Consolidated pre-commit uninstall behavior (leave .bak files in place) as user-recoverable rather than auto-cleanup"
+metrics:
+  duration: "~4m"
+  completed: "2026-04-05"
+  tasks: 2
+  files: 2
+---
+
+# Phase 7 Plan 06: CI/CD Documentation Summary
+
+One-liner: Documented the Phase 7 deliverables (pre-commit hook, GitHub Actions SARIF upload, external scanner import) in a standalone `docs/CI-CD.md` guide and cross-linked it from the README's existing CI/CD Integration section.
+
+## What Was Built
+
+- **`docs/CI-CD.md`** — 161-line guide with five sections:
+  1. Title and scope intro
+  2. Pre-commit hook install (`keyhunter hook install`), `--force` backup semantics, `git commit --no-verify` bypass, and `keyhunter hook uninstall`
+  3. GitHub Actions workflow example (copy-paste `.github/workflows/keyhunter.yml`) with full explanation of `continue-on-error: true`, `security-events: write`, and `fetch-depth: 0`
+  4. External scanner import walkthrough for TruffleHog JSON, Gitleaks JSON, and Gitleaks CSV — including idempotency guarantee
+  5. Exit-code table (0/1/2) for CI integration gating
+
+- **`README.md` CI/CD Integration section** — replaced the three-line stub with a 2-paragraph summary that covers all three capabilities, shows the canonical command shapes (including `keyhunter import`), and links out to `docs/CI-CD.md` for the full walkthrough.
+
+## Tasks Completed
+
+| Task | Name                                                 | Commit   | Files         |
+| ---- | ---------------------------------------------------- | -------- | ------------- |
+| 1    | Write docs/CI-CD.md with GH Actions + pre-commit     | e4a71bb  | docs/CI-CD.md |
+| 2    | Update README.md with CI/CD integration link         | 87c5a00  | README.md     |
+
+## Verification
+
+Both automated verify blocks from the plan passed:
+
+```
+test -f docs/CI-CD.md && grep -q "upload-sarif" docs/CI-CD.md \
+  && grep -q "keyhunter hook install" docs/CI-CD.md \
+  && grep -q "keyhunter import --format=trufflehog" docs/CI-CD.md
+# -> T1_OK
+
+grep -q "docs/CI-CD.md" README.md && grep -q "CI/CD" README.md
+# -> T2_OK
+```
+
+Overall plan verification (`grep -q "upload-sarif" docs/CI-CD.md && grep -q "docs/CI-CD.md" README.md`) passes.
+
+## Requirements Satisfied
+
+- **CICD-01** (pre-commit hook integration) — install/force/uninstall lifecycle and bypass path are user-discoverable from README via the new guide.
+- **CICD-02** (GitHub Actions SARIF upload) — full copy-paste workflow published, with permissions and `continue-on-error` rationale documented.
+
+## Deviations from Plan
+
+None — plan executed exactly as written. The README already had a stub `### CI/CD Integration` subsection under Quick Start (line 372) that the plan anticipated ("update if a stub section exists"); expanded in place rather than relocating.
+
+## Key Decisions Made
+
+1. **In-place README expansion** — kept the existing `### CI/CD Integration` heading under the Quick Start H2 rather than promoting it to its own H2 section. This preserves the Quick Start flow established by earlier phases and matches the plan's "update if a stub section exists" guidance.
+2. **`continue-on-error: true` rationale documented explicitly** — users copying a security workflow deserve to know why a "failing" step is intentional; otherwise the first instinct is to remove it and lose the SARIF upload.
+3. **`.bak.<timestamp>` files left in place on uninstall** — documented as manual-recovery rather than auto-cleanup, so users never silently lose a prior hook.
+
+## Self-Check: PASSED
+
+- FOUND: docs/CI-CD.md
+- FOUND: commit e4a71bb (docs(07-06): add CI/CD integration guide)
+- FOUND: commit 87c5a00 (docs(07-06): link README CI/CD section to full guide)
+- FOUND: README.md contains `docs/CI-CD.md` link
+- FOUND: docs/CI-CD.md contains `upload-sarif`, `keyhunter hook install`, `keyhunter import --format=trufflehog`