46 lines
1.3 KiB
YAML
46 lines
1.3 KiB
YAML
name: CI - Security, Lint & Tests
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
# This workflow validates branches only. It has no deployment step and no
|
|
# write permission, so an audit-branch push cannot alter main or production.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: '3.12'
|
|
cache: pip
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r requirements.txt -r requirements-dev.txt
|
|
|
|
- name: Audit declared dependencies
|
|
run: pip-audit -r requirements.txt
|
|
|
|
- name: Lint and check formatting
|
|
run: |
|
|
ruff check .
|
|
ruff format --check .
|
|
|
|
- name: Run tests with coverage gate
|
|
run: pytest --cov=app --cov-report=term-missing --cov-report=xml
|
|
|
|
- name: Run repository security checks
|
|
env:
|
|
SECRET_KEY: audit-ci-key-not-for-production-1234567890
|
|
DATABASE_URL: 'sqlite:///:memory:'
|
|
FLASK_DEBUG: 'false'
|
|
run: python app/supporting_scripts/security_scan.py --skip-http
|