docs: add RELEASE_v0.5.1 notes for Bezalel CI/infra upgrade

Refs #192

Documents the 13 commits merged to main:
- Syntax Guard CI (#167)
- Gitea Workflow Automation skill (#181)
- Forge Health Check false-positive fix (#175)
- CI uv caching (#187)
- CI runner container pinning (#180/#174)
- Syntax error fix in test_skill_name_traversal.py (#188)
- Ezra model fallback chain (kimi-k2.5 primary)

All changes verified: syntax guard passes, EXCLUDED_PATH_SEGMENTS
present, Ezra config updated, skill file present.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -13,6 +13,7 @@ concurrency:
 jobs:
   smoke-and-build:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -20,6 +21,9 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
 
       - name: Set up Python 3.11
         run: uv python install 3.11

.gitea/workflows/notebook-ci.yml

@@ -11,6 +11,7 @@ on:
 jobs:
   notebook-smoke:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/dependency-audit.yml

@@ -19,6 +19,7 @@ jobs:
   audit:
     name: Audit Python dependencies
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5

.github/workflows/docs-site-checks.yml

@@ -10,6 +10,7 @@ on:
 jobs:
   docs-site-checks:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/quarterly-security-audit.yml

@@ -19,6 +19,7 @@ jobs:
   create-audit-issue:
     name: Create quarterly security audit issue
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/secret-scan.yml

@@ -12,6 +12,7 @@ jobs:
   scan:
     name: Scan for secrets
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/supply-chain-audit.yml

@@ -12,6 +12,7 @@ jobs:
   scan:
     name: Scan PR for supply chain risks
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/tests.yml

@@ -14,6 +14,7 @@ concurrency:
 jobs:
   test:
     runs-on: ubuntu-latest
+    container: catthehacker/ubuntu:act-22.04
     timeout-minutes: 10
     steps:
       - name: Checkout code

RELEASE_v0.5.1.md

@@ -0,0 +1,91 @@
+# Hermes Agent v0.5.1 (v2026.4.7)
+
+**Release Date:** April 7, 2026
+
+> The Forge hardening release — CI pipeline with syntax guard, health check false-positive elimination, Ezra model fallback chain, and Gitea workflow automation skill.
+
+---
+
+## ✨ Highlights
+
+- **Syntax Guard CI** — New `scripts/syntax_guard.py` compiles all `*.py` files pre-merge, preventing broken Python from ever reaching `main`. Integrated as a required step in `.gitea/workflows/ci.yml`.
+
+- **Forge Health Check — 13,449 false positives eliminated** — Added `EXCLUDED_PATH_SEGMENTS` to skip `.cache`, `__pycache__`, `.venv`, `node_modules`, `.git`, `.tox` in sensitive-file scans. Reduced noise from 13,449 false positives to 3 real findings.
+
+- **Ezra resurrected with fallback chain** — Switched Ezra primary from `kimi-for-coding` (terminated 403) to `kimi-k2.5`. Added fallback chain: Kimi → Anthropic → OpenRouter.
+
+- **Gitea Workflow Automation Skill** — New `skills/devops/gitea-workflow-automation/SKILL.md` gives all wizards step-by-step API workflows for creating issues, PRs, comments, and status checks.
+
+---
+
+## 🏗️ CI / Infrastructure
+
+### Syntax Guard (#167)
+- Added `scripts/syntax_guard.py` — compiles all `*.py` files to catch syntax errors before merge
+- Integrated into `.gitea/workflows/ci.yml` as a required step
+
+### CI uv Caching (#187)
+- Enabled `enable-cache: true` with `cache-dependency-glob: "uv.lock"` in all CI workflows
+- Faster CI runs, less redundant dependency resolution
+
+### CI Runner Container Pinning (#180 / #174)
+- Pinned all workflow jobs to `container: catthehacker/ubuntu:act-22.04`
+- Fixes act runner failures (Node.js missing in default container)
+- Gitea Actions now compatible with local act runners
+
+---
+
+## 🐛 Bug Fixes
+
+### Forge Health Check False Positives (#175)
+- Added `EXCLUDED_PATH_SEGMENTS` to skip `.cache`, `__pycache__`, `.venv`, `node_modules`, `.git`, `.tox`, `site-packages`
+- Excluded `.css` files and `secret_scan*.py` tooling from sensitive-file scan
+
+### Syntax Error Fix (#188)
+- Fixed indentation error in `tests/agent/test_skill_name_traversal.py` line 282
+- Unblocked CI — all tests can run again
+
+### Ezra Model Fallback Fix
+- Switched Ezra primary from `kimi-for-coding` (403 terminated) to `kimi-k2.5`
+- Added fallback chain: Kimi → Anthropic → OpenRouter
+- Ezra is operational again with robust failover
+
+---
+
+## 🛠️ New Skills
+
+### Gitea Workflow Automation (#181)
+- `skills/devops/gitea-workflow-automation/SKILL.md`
+- Provides step-by-step API workflows for: listing issues, creating issues, opening PRs, merging PRs, adding comments, creating releases, checking CI status
+- Prerequisites: `GITEA_URL`, `GITEA_TOKEN`, `GITEA_USER` env vars + `curl` and `jq`
+
+---
+
+## Files Changed
+
+```
+.gitea/workflows/ci.yml                  |   9 ++
+.gitea/workflows/notebook-ci.yml         |   1 +
+.github/workflows/*.yml                  |   6 +
+config/ezra-kimi-primary.yaml            |  64 +++++++---------
+scripts/forge_health_check.py            |  22 +++++
+scripts/syntax_guard.py                  |  20 +++++
+skills/devops/gitea-workflow-automation/ | 100 +++++++++++++++++++++++
+tests/agent/test_skill_name_traversal.py |   2 +-
+15 files changed, 190 insertions(+), 38 deletions(-)
+```
+
+---
+
+## Verification
+
+- [x] Syntax guard passes: `python3 scripts/syntax_guard.py` → "All Python files compile successfully"
+- [x] `EXCLUDED_PATH_SEGMENTS` present in `scripts/forge_health_check.py`
+- [x] `skills/devops/gitea-workflow-automation/SKILL.md` present
+- [x] Ezra config: `kimi-k2.5` primary with Anthropic + OpenRouter fallback chain
+- [x] Fast-forward merge completed successfully
+- [x] No dependency changes (`pyproject.toml`, `requirements.txt` unchanged)
+
+---
+
+*Compiled by Claude — reviewing Bezalel's upgrade report (issue #192)*

scripts/forge_health_check.py

@@ -98,9 +98,23 @@ class HealthReport:
             self.passed = False
 
 
+EXCLUDED_PATH_SEGMENTS = frozenset({
+    ".cache", "__pycache__", ".venv", "venv", "site-packages",
+    ".local/share/uv", "node_modules", ".git", ".tox",
+})
+
+
+def _is_excluded_path(path: Path) -> bool:
+    """Skip cache, venv, and package-manager directories."""
+    parts = set(path.parts)
+    return not parts.isdisjoint(EXCLUDED_PATH_SEGMENTS)
+
+
 def scan_orphaned_bytecode(root: Path, report: HealthReport) -> None:
     """Detect .pyc files without corresponding .py source files."""
     for pyc in root.rglob("*.pyc"):
+        if _is_excluded_path(pyc):
+            continue
         py = pyc.with_suffix(".py")
         if not py.exists():
             # Also check __pycache__ naming convention
@@ -142,6 +156,12 @@ def _is_sensitive_filename(name: str) -> bool:
     lower = name.lower()
     if lower == ".env.example":
         return False
+    # Skip stylesheet and documentation artifacts
+    if lower.endswith(".css"):
+        return False
+    # Skip scanner tooling — these are detectors, not secrets
+    if lower in {"secret_scan.py", "secret_scanner.py"}:
+        return False
     if any(pat in lower for pat in SENSITIVE_FILE_PATTERNS):
         return True
     if any(lower.startswith(pref) for pref in SENSITIVE_NAME_PREFIXES):
@@ -156,6 +176,8 @@ def scan_sensitive_file_permissions(root: Path, report: HealthReport, fix: bool
     for fpath in root.rglob("*"):
         if not fpath.is_file():
             continue
+        if _is_excluded_path(fpath):
+            continue
         # Skip test files — real secrets should never live in tests/
         if "/tests/" in str(fpath) or str(fpath).startswith(str(root / "tests")):
             continue