security.yml

name: Security and Lint Checks

on:
  push:
    branches: [ main, develop, 'feature/**' ]
    paths:
      - 'src/**'
      - 'pyproject.toml'
      - '.github/workflows/security.yml'
  pull_request:
    branches: [ main, develop ]
    paths:
      - 'src/**'
      - 'pyproject.toml'

env:
  PYTHON_VERSION: '3.11'

jobs:
  security-and-lint:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: ${{ env.PYTHON_VERSION }}

    - name: Cache Python dependencies
      uses: actions/cache@v3
      with:
        path: ~/.cache/pip
        key: ${{ runner.os }}-pip-${{ env.PYTHON_VERSION }}-security-${{ hashFiles('pyproject.toml') }}
        restore-keys: |
          ${{ runner.os }}-pip-${{ env.PYTHON_VERSION }}-security-
          ${{ runner.os }}-pip-${{ env.PYTHON_VERSION }}-

    - name: Install security tools
      run: |
        python -m pip install --upgrade pip
        pip install bandit safety pip-audit

    - name: Install package
      run: |
        pip install -e ".[dev]"

    - name: Run bandit security linter
      run: |
        bandit -r src/ -f json -o bandit-report.json || true
        bandit -r src/ 

    - name: Run safety check for dependencies
      run: |
        safety check --json --output safety-report.json || true
        safety check

    - name: Run pip-audit for vulnerability scanning
      run: |
        pip-audit --format=json --output=audit-report.json || true
        pip-audit

    - name: Upload security reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-reports
        path: |
          bandit-report.json
          safety-report.json
          audit-report.json
        retention-days: 30