scanner-ci.yaml

name: Veritensor CI

on:
  push:
    branches: [ "main" ]
    paths-ignore:
      - '**.md'
      - 'docs/**'
  pull_request:
    branches: [ "main" ]
    paths-ignore:
      - '**.md'

jobs:
  test:
    name: Unit Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11"]

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install "wheel>=0.46.2" 
          pip install -e .[test]

      - name: Install Cosign (for signing tests)
        uses: sigstore/cosign-installer@v3.3.0

      - name: Run Tests
        run: |
          pytest tests/ -v

  security-audit:
    name: Security Audit (Trivy)
    runs-on: ubuntu-latest
    needs: test 
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build Docker Image
        run: docker build -t veritensor:test .

      - name: Run Trivy Vulnerability Scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'veritensor:test'
          format: 'table'
          # We are not blocking the build yet (exit-code 0) so that you can see the report, 
          # but the release did not stop due to minor vulnerabilities in the basic python image
          exit-code: '1' 
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          trivyignores: .trivyignore