diff --git a/.github/labeler.yml b/.github/labeler.yml
new file mode 100644
index 0000000..8d21ea8
--- /dev/null
+++ b/.github/labeler.yml
@@ -0,0 +1,39 @@
+core:
+  - changed-files:
+    - any-glob-to-any-file: 'core/**'
+
+agents:
+  - changed-files:
+    - any-glob-to-any-file: 'agents/**'
+
+autopilot:
+  - changed-files:
+    - any-glob-to-any-file: 'autopilot/**'
+
+overseer-findings:
+  - changed-files:
+    - any-glob-to-any-file: 'overseer/**'
+
+ci/cd:
+  - changed-files:
+    - any-glob-to-any-file: '.github/**'
+
+testing:
+  - changed-files:
+    - any-glob-to-any-file: 'tests/**'
+
+documentation:
+  - changed-files:
+    - any-glob-to-any-file: 'docs/**'
+    - any-glob-to-any-file: '*.md'
+
+maintenance:
+  - changed-files:
+    - any-glob-to-any-file: 'scripts/**'
+    - any-glob-to-any-file: '.github/scripts/**'
+
+dependencies:
+  - changed-files:
+    - any-glob-to-any-file: 'requirements*.txt'
+    - any-glob-to-any-file: 'pyproject.toml'
+    - any-glob-to-any-file: 'setup.py'
diff --git a/.github/scripts/deployment-automation.sh b/.github/scripts/deployment-automation.sh
index 59b73b7..4b656f3 100644
--- a/.github/scripts/deployment-automation.sh
+++ b/.github/scripts/deployment-automation.sh
@@ -98,7 +98,7 @@ echo "1) Self-hosted (Local installation)"
 echo "2) Docker (Containerized deployment)"
 echo "3) Kubernetes (K8s cluster deployment)"
 echo "4) Cloud Platform (AWS/GCP/Azure)"
-read -p "Enter choice [1-4]: " DEPLOY_MODE
+read -r -p "Enter choice [1-4]: " DEPLOY_MODE
 
 case $DEPLOY_MODE in
     1)
@@ -119,6 +119,7 @@ case $DEPLOY_MODE in
         # Create virtual environment
         info "Setting up Python virtual environment..."
         python3 -m venv venv
+        # shellcheck source=/dev/null
         source venv/bin/activate
         success "Virtual environment created"
 
@@ -193,7 +194,7 @@ case $DEPLOY_MODE in
         docker run -d \
             --name autonomous-github-agent \
             --env-file .env \
-            -v $(pwd)/.github:/app/.github \
+            -v "$(pwd)/.github":/app/.github \
             -p 8080:8080 \
             autonomous-github-agent:latest
 
@@ -225,9 +226,9 @@ case $DEPLOY_MODE in
 
         # Create secrets
         info "Setting up secrets..."
-        read -p "Enter GitHub Token: " GITHUB_TOKEN
+        read -r -p "Enter GitHub Token: " GITHUB_TOKEN
         kubectl create secret generic github-credentials \
-            --from-literal=token=$GITHUB_TOKEN \
+            --from-literal=token="$GITHUB_TOKEN" \
             -n autonomous-agent || true
 
         # Apply manifests
@@ -247,7 +248,7 @@ case $DEPLOY_MODE in
         echo "1) AWS (ECS/EKS)"
         echo "2) Google Cloud (Cloud Run/GKE)"
         echo "3) Azure (Container Instances/AKS)"
-        read -p "Enter choice [1-3]: " CLOUD_CHOICE
+        read -r -p "Enter choice [1-3]: " CLOUD_CHOICE
 
         case $CLOUD_CHOICE in
             1)
diff --git a/.github/workflows/agent_dispatcher.yml b/.github/workflows/agent_dispatcher.yml
index c163c50..7f77298 100644
--- a/.github/workflows/agent_dispatcher.yml
+++ b/.github/workflows/agent_dispatcher.yml
@@ -79,11 +79,11 @@ jobs:
     needs: route
     if: needs.route.outputs.should_risk_score == 'true' && github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
           cache: pip
@@ -192,7 +192,7 @@ jobs:
     steps:
       - name: Label PR by changed paths
         if: github.event_name == 'pull_request'
-        uses: actions/labeler@v5
+        uses: actions/labeler@v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: false
diff --git a/.github/workflows/ai_agent_workflow.yml b/.github/workflows/ai_agent_workflow.yml
index 61d26b3..2278815 100644
--- a/.github/workflows/ai_agent_workflow.yml
+++ b/.github/workflows/ai_agent_workflow.yml
@@ -30,15 +30,15 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/pip
@@ -60,7 +60,7 @@ jobs:
 
       - name: Upload coverage
         if: matrix.python-version == '3.11'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           file: ./coverage.xml
           fail_ci_if_error: false
@@ -68,14 +68,14 @@ jobs:
   code-quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-quality-${{ hashFiles('requirements.txt') }}
@@ -96,14 +96,14 @@ jobs:
     if: github.event_name == 'push' || !github.event.pull_request.draft
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
       - name: Cache dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
@@ -128,7 +128,7 @@ jobs:
         run: python .github/scripts/docgen.py
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: agent-outputs
diff --git a/.github/workflows/branch_protection.yml b/.github/workflows/branch_protection.yml
index 8f94724..28e0512 100644
--- a/.github/workflows/branch_protection.yml
+++ b/.github/workflows/branch_protection.yml
@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.12'
           cache: 'pip'
diff --git a/.github/workflows/code-quality-optimized.yml b/.github/workflows/code-quality-optimized.yml
index b269cb6..f0d9202 100644
--- a/.github/workflows/code-quality-optimized.yml
+++ b/.github/workflows/code-quality-optimized.yml
@@ -36,18 +36,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 1  # Shallow clone for speed
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
 
       - name: Cache pip dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: |
             ~/.cache/pip
@@ -79,7 +79,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload analysis results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: analysis-results
@@ -90,7 +90,7 @@ jobs:
 
       - name: Comment PR with results
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -138,10 +138,10 @@ jobs:
         python-version: ['3.10', '3.11', '3.12']
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
@@ -175,7 +175,7 @@ jobs:
 
       - name: Upload coverage reports
         if: matrix.python-version == '3.11'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           file: ./coverage.xml
           flags: unittests
@@ -184,7 +184,7 @@ jobs:
 
       - name: Upload HTML coverage report
         if: matrix.python-version == '3.11'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: coverage-report
           path: htmlcov/
@@ -197,10 +197,10 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -234,7 +234,7 @@ jobs:
           "
 
       - name: Upload Bandit results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: bandit-security-report
@@ -242,7 +242,7 @@ jobs:
 
       - name: Create security issue if critical vulnerabilities found
         if: failure() && steps.check_critical.outcome == 'failure'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -281,10 +281,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -305,7 +305,7 @@ jobs:
 
       - name: Comment on PR with complexity changes
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -321,7 +321,7 @@ jobs:
             }
 
       - name: Upload complexity reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: complexity-reports
           path: |
@@ -336,10 +336,10 @@ jobs:
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
 
       - name: Generate health dashboard
         run: |
diff --git a/.github/workflows/dry_run_gate.yml b/.github/workflows/dry_run_gate.yml
index d72f953..a3dcfaf 100644
--- a/.github/workflows/dry_run_gate.yml
+++ b/.github/workflows/dry_run_gate.yml
@@ -38,9 +38,9 @@ jobs:
       plan_summary: ${{ steps.plan.outputs.summary }}
       risk_level: ${{ steps.plan.outputs.risk_level }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
           cache: pip
@@ -171,9 +171,9 @@ jobs:
       needs.check-approval.outputs.approved == 'true'
     environment: production  # requires environment protection rules if configured
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
           cache: pip
diff --git a/.github/workflows/elite_copilot.yml b/.github/workflows/elite_copilot.yml
index 22ee678..87f40b1 100644
--- a/.github/workflows/elite_copilot.yml
+++ b/.github/workflows/elite_copilot.yml
@@ -39,12 +39,12 @@ jobs:
 
     steps:
       - name: "📥 Checkout Repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0 # Full history for better analysis
 
       - name: "🐍 Setup Python"
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -92,7 +92,7 @@ jobs:
           echo "::endgroup::"
 
       - name: "📊 Upload Analysis Report"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: copilot-analysis-report
@@ -103,7 +103,7 @@ jobs:
 
       - name: "💬 Post PR Comment"
         if: github.event_name == 'pull_request' && always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -131,7 +131,7 @@ jobs:
 
       - name: "🏷️ Auto-label Issues"
         if: github.event_name == 'issues' && github.event.action == 'opened'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -177,10 +177,10 @@ jobs:
 
     steps:
       - name: "📥 Checkout Code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: "🐍 Setup Python"
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -196,7 +196,7 @@ jobs:
           safety check --json > safety-report.json || true
 
       - name: "📊 Upload Security Reports"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: security-reports
@@ -214,10 +214,10 @@ jobs:
 
     steps:
       - name: "📥 Checkout Code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: "🐍 Setup Python"
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -233,7 +233,7 @@ jobs:
           radon mi . -s -j > maintainability-report.json || true
 
       - name: "📈 Upload Performance Reports"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: performance-reports
@@ -251,10 +251,10 @@ jobs:
 
     steps:
       - name: "📥 Checkout Code"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: "🐍 Setup Python"
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -274,7 +274,7 @@ jobs:
           python autopilot.py --config config.yaml --output ../DAILY_SUMMARY.md
 
       - name: "📤 Upload Daily Summary"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: daily-summary
@@ -282,7 +282,7 @@ jobs:
           if-no-files-found: warn
 
       - name: "💬 Create or Update Summary Issue"
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         if: always()
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/monitoring_export.yml b/.github/workflows/monitoring_export.yml
index 9da1caf..c6aa548 100644
--- a/.github/workflows/monitoring_export.yml
+++ b/.github/workflows/monitoring_export.yml
@@ -26,10 +26,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -204,7 +204,7 @@ jobs:
           EOF
 
       - name: Upload metrics artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: workflow-metrics
           path: monitoring/metrics/
diff --git a/.github/workflows/pre-commit-ci.yml b/.github/workflows/pre-commit-ci.yml
index 993aeb5..ffc24d7 100644
--- a/.github/workflows/pre-commit-ci.yml
+++ b/.github/workflows/pre-commit-ci.yml
@@ -24,19 +24,19 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
 
       - name: Cache pre-commit environments
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ runner.os }}-${{ hashFiles('.pre-commit-config.yaml') }}
@@ -74,7 +74,7 @@ jobs:
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const autoFixed = process.env.AUTO_FIXED === 'true';
@@ -121,7 +121,7 @@ jobs:
 
       - name: Upload pre-commit results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: pre-commit-results
           path: |
diff --git a/.github/workflows/release-and-publish.yml b/.github/workflows/release-and-publish.yml
index f2664e8..3b8b76e 100644
--- a/.github/workflows/release-and-publish.yml
+++ b/.github/workflows/release-and-publish.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set version
         id: version
@@ -34,7 +34,7 @@ jobs:
           echo "Release version: $VERSION"
 
       - name: Setup Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -64,13 +64,10 @@ jobs:
           python -m twine upload dist/* --skip-existing
 
       - name: Create GitHub Release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: softprops/action-gh-release@v2
         with:
           tag_name: v${{ steps.version.outputs.version }}
-          release_name: Release v${{ steps.version.outputs.version }}
+          name: Release v${{ steps.version.outputs.version }}
           body: |
             ## Autonomous GitHub Agent v${{ steps.version.outputs.version }}
 
@@ -103,16 +100,7 @@ jobs:
             **Full Changelog**: https://github.com/labgadget015-dotcom/autonomous-github-agent/commits/v${{ steps.version.outputs.version }}
           draft: false
           prerelease: false
-
-      - name: Upload release assets
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./dist/
-          asset_name: autonomous-github-agent-${{ steps.version.outputs.version }}.tar.gz
-          asset_content_type: application/gzip
+          files: ./dist/*
 
       - name: Publish to GitHub Marketplace
         run: |
@@ -121,7 +109,7 @@ jobs:
           echo "Version: v${{ steps.version.outputs.version }}"
 
       - name: Notify on success
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/repository-overseer.yml b/.github/workflows/repository-overseer.yml
index 9c537ba..b52b7b7 100644
--- a/.github/workflows/repository-overseer.yml
+++ b/.github/workflows/repository-overseer.yml
@@ -48,12 +48,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0  # Full history for better analysis
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
           cache: 'pip'
@@ -80,7 +80,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload analysis results
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: overseer-results
@@ -167,7 +167,7 @@ jobs:
 
       - name: Create issue for critical findings
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -275,10 +275,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3.11'
 
@@ -298,7 +298,7 @@ jobs:
           pip-audit --format json --output pip-audit-report.json || true
 
       - name: Upload security reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: security-reports
diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml
index 0c7e8a7..d746cbb 100644
--- a/.github/workflows/security_scan.yml
+++ b/.github/workflows/security_scan.yml
@@ -30,16 +30,16 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
 
       - name: Cache Bandit installation
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-bandit-${{ env.CACHE_VERSION }}
@@ -121,7 +121,7 @@ jobs:
           EOF
 
       - name: Upload Bandit artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: bandit-security-reports
@@ -135,10 +135,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -155,7 +155,7 @@ jobs:
         continue-on-error: true
 
       - name: Upload pip-audit reports
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: pip-audit-reports
@@ -169,18 +169,18 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - name: Run Gitleaks
-        uses: gitleaks/gitleaks-action@v2
+        uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
 
       - name: Upload Gitleaks report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         if: always()
         with:
           name: gitleaks-report
@@ -196,12 +196,12 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           path: all-reports/
 
       - name: Generate security summary comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -287,13 +287,13 @@ jobs:
 
     steps:
       - name: Download Bandit report
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: bandit-security-reports
           path: reports/
 
       - name: Create GitHub issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const fs = require('fs');
@@ -342,7 +342,7 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 2
 
diff --git a/.github/workflows/test_metrics.yml b/.github/workflows/test_metrics.yml
index 2bebddd..b6b4ea4 100644
--- a/.github/workflows/test_metrics.yml
+++ b/.github/workflows/test_metrics.yml
@@ -38,9 +38,9 @@ jobs:
         run: [1, 2, 3]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
           cache: pip
@@ -69,7 +69,7 @@ jobs:
             --tb=no \
           || true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: test-results-run-${{ matrix.run }}
           path: test-results*.json
@@ -80,16 +80,16 @@ jobs:
     runs-on: ubuntu-latest
     needs: flaky-detection
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v7
         with:
           pattern: test-results-run-*
           merge-multiple: true
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.11"
 
@@ -196,7 +196,7 @@ jobs:
               print("::warning::Flaky tests detected — see step summary for details.")
           PYEOF
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v6
         with:
           name: metrics-summary
           path: metrics_run.json
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..183e350
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,6 @@
+[allowlist]
+  description = "Known false positives"
+  paths = [
+    '''.secrets.baseline''',
+    '''docs/API_EXAMPLES.md''',
+  ]
diff --git a/autopilot/autopilot.py b/autopilot/autopilot.py
index a2a9fd7..0769442 100644
--- a/autopilot/autopilot.py
+++ b/autopilot/autopilot.py
@@ -296,11 +296,24 @@ def run(self, output_file: str | None = None) -> str:
             print("=" * 60 + "\n")
 
         # Write to file
-        output_path = output_file or self.config["output"].get(
-            "file", "DAILY_SUMMARY.md"
-        )
-        if output_path:
-            output_file_path = Path(__file__).parent.parent / output_path
+        # When output_file is supplied via --output on the CLI, resolve it
+        # relative to the caller's working directory so that invocations like
+        #   cd autopilot && python autopilot.py --output ../DAILY_SUMMARY.md
+        # land the file at the repo root as intended.
+        # When the path comes from config (no --output arg), keep the existing
+        # behaviour of rooting at the repo root via Path(__file__).parent.parent.
+        config_output_path = self.config["output"].get("file", "DAILY_SUMMARY.md")
+
+        if output_file:
+            output_file_path = Path(output_file)
+            if not output_file_path.is_absolute():
+                output_file_path = Path.cwd() / output_file_path
+        elif config_output_path:
+            output_file_path = Path(__file__).parent.parent / config_output_path
+        else:
+            output_file_path = None
+
+        if output_file_path is not None:
             with open(output_file_path, "w") as f:
                 f.write(summary)
             print(f"✅ Summary written to: {output_file_path}")
diff --git a/scripts/automation/create-release.sh b/scripts/automation/create-release.sh
index c091475..10647e3 100755
--- a/scripts/automation/create-release.sh
+++ b/scripts/automation/create-release.sh
@@ -29,7 +29,7 @@ echo "1) Patch (v$MAJOR.$MINOR.$((PATCH+1)))"
 echo "2) Minor (v$MAJOR.$((MINOR+1)).0)"
 echo "3) Major (v$((MAJOR+1)).0.0)"
 echo "4) Custom"
-read -p "Enter choice [1-4]: " choice
+read -r -p "Enter choice [1-4]: " choice
 
 case $choice in
     1)
@@ -42,7 +42,7 @@ case $choice in
         NEW_VERSION="v$((MAJOR+1)).0.0"
         ;;
     4)
-        read -p "Enter custom version (e.g., v1.2.3): " NEW_VERSION
+        read -r -p "Enter custom version (e.g., v1.2.3): " NEW_VERSION
         ;;
     *)
         echo -e "${RED}Invalid choice${NC}"
@@ -56,11 +56,11 @@ echo -e "${YELLOW}Creating release: $NEW_VERSION${NC}"
 # Get commit messages since last tag
 echo ""
 echo "Recent changes:"
-git log $CURRENT_VERSION..HEAD --oneline --decorate
+git log "$CURRENT_VERSION"..HEAD --oneline --decorate
 
 # Confirm
 echo ""
-read -p "Proceed with release $NEW_VERSION? [y/N]: " confirm
+read -r -p "Proceed with release $NEW_VERSION? [y/N]: " confirm
 if [[ ! $confirm =~ ^[Yy]$ ]]; then
     echo "Release cancelled"
     exit 0
diff --git a/scripts/automation/lint-code.sh b/scripts/automation/lint-code.sh
index 73cc39a..6ec7309 100755
--- a/scripts/automation/lint-code.sh
+++ b/scripts/automation/lint-code.sh
@@ -7,7 +7,7 @@ echo "🔍 Running linters..."
 EXIT_CODE=0
 
 # Python linting
-if ls *.py 2>/dev/null || [ -d "scripts" ] || [ -d "src" ]; then
+if ls ./*.py 2>/dev/null || [ -d "scripts" ] || [ -d "src" ]; then
     echo "Linting Python code..."
 
     # flake8
@@ -19,7 +19,7 @@ if ls *.py 2>/dev/null || [ -d "scripts" ] || [ -d "src" ]; then
     # pylint
     if command -v pylint &> /dev/null; then
         echo "Running pylint..."
-        find . -name "*.py" -not -path "./.venv/*" -not -path "./venv/*" | xargs pylint || EXIT_CODE=1
+        find . -name "*.py" -not -path "./.venv/*" -not -path "./venv/*" -print0 | xargs -0 pylint || EXIT_CODE=1
     fi
 
     # mypy
diff --git a/scripts/automation/setup-dev-env.sh b/scripts/automation/setup-dev-env.sh
index 9da674b..3836228 100755
--- a/scripts/automation/setup-dev-env.sh
+++ b/scripts/automation/setup-dev-env.sh
@@ -32,6 +32,7 @@ fi
 
 # Activate virtual environment
 echo "Activating virtual environment..."
+# shellcheck source=/dev/null
 source .venv/bin/activate 2>/dev/null || source .venv/Scripts/activate 2>/dev/null
 
 # Upgrade pip
@@ -66,4 +67,5 @@ echo "✅ Development environment setup complete!"
 echo ""
 echo "To activate the environment:"
 echo "  source .venv/bin/activate  # Linux/macOS"
-echo "  .venv\Scripts\activate     # Windows"
+# shellcheck disable=SC2028
+echo '  .venv\Scripts\activate     # Windows'
diff --git a/scripts/automation/setup_python.sh b/scripts/automation/setup_python.sh
index f15628f..eda8d53 100755
--- a/scripts/automation/setup_python.sh
+++ b/scripts/automation/setup_python.sh
@@ -20,6 +20,7 @@ fi
 
 # Activate virtual environment
 echo "Activating virtual environment..."
+# shellcheck source=/dev/null
 source venv/bin/activate
 
 # Upgrade pip
diff --git a/scripts/setup-dev.sh b/scripts/setup-dev.sh
index 2f39f26..a4a518c 100755
--- a/scripts/setup-dev.sh
+++ b/scripts/setup-dev.sh
@@ -77,8 +77,10 @@ install_dependencies() {
 
     # Activate virtual environment
     if [ -f "venv/bin/activate" ]; then
+        # shellcheck source=/dev/null
         source venv/bin/activate
     elif [ -f "venv/Scripts/activate" ]; then
+        # shellcheck source=/dev/null
         source venv/Scripts/activate
     else
         print_error "Virtual environment not found. Please create it first."
@@ -117,6 +119,7 @@ install_precommit() {
     print_header "Installing Pre-commit Hooks"
 
     if [ -f "venv/bin/activate" ]; then
+        # shellcheck source=/dev/null
         source venv/bin/activate
     fi
 
@@ -146,6 +149,7 @@ run_tests() {
     print_header "Running Initial Tests"
 
     if [ -f "venv/bin/activate" ]; then
+        # shellcheck source=/dev/null
         source venv/bin/activate
     fi
 
diff --git a/start.sh b/start.sh
index 8816138..2154d0e 100644
--- a/start.sh
+++ b/start.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/bin/bash
 # Quick start script for Autonomous GitHub Agent (Linux/macOS)
 
 set -e
@@ -30,7 +30,7 @@ if [ ! -f ".env" ]; then
         echo ""
         echo "IMPORTANT: Please edit .env file with your configuration!"
         echo "Run: nano .env (or use your preferred editor)"
-        read -p "Press Enter to continue after editing .env..."
+        read -r -p "Press Enter to continue after editing .env..."
     else
         echo "ERROR: .env.example not found"
         exit 1