ci.yml

name: IpverseBot CI/CD

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [3.8, 3.9, '3.10', 3.11, 3.12]

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt

    - name: Lint with flake8
      run: |
        pip install flake8
        # Stop the build if there are Python syntax errors or undefined names
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
        # Exit-zero treats all errors as warnings. GitHub editor is 127 chars wide
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics

    - name: Type check with mypy
      run: |
        pip install mypy types-aiofiles
        mypy --ignore-missing-imports .

    - name: Test configuration loading
      run: |
        export BOT_TOKEN="test_token"
        export ADMIN_ID="123456789"
        python -c "from config.settings import API_TOKEN, ADMIN_ID; print('Config test passed')"

  docker:
    runs-on: ubuntu-latest
    needs: test

    steps:
    - uses: actions/checkout@v4

    - name: Build Docker image
      run: |
        docker build -t ipversebot:test .

    - name: Test Docker image
      run: |
        docker run --rm \
          -e BOT_TOKEN=test_token \
          -e ADMIN_ID=123456789 \
          ipversebot:test python -c "print('Docker test passed')"

  security:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4

    - name: Run security scan
      uses: securecodewarrior/github-action-add-sarif@v1
      with:
        sarif-file: 'security-scan-results.sarif'
      continue-on-error: true

    - name: Check for secrets
      run: |
        # Check if any secrets are accidentally committed
        if grep -r "BOT_TOKEN.*=" . --exclude-dir=.git --exclude="*.md" --exclude=".env.example"; then
          echo "❌ Found potential secret in code"
          exit 1
        fi
        echo "✅ No secrets found in code"