ci.yml

name: CI

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Cache Poetry
        uses: actions/cache@v4
        with:
          path: ~/.local
          key: poetry-1.8.3

      - name: Install Poetry
        run: |
          if ! command -v poetry &> /dev/null; then
            curl -sSL https://install.python-poetry.org | python3 -
          fi
          echo "$HOME/.local/bin" >> $GITHUB_PATH

      - name: Set up Python 3.12
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: "poetry"

      - name: Install dependencies
        run: poetry install

      - name: Lint and Format check
        run: |
          poetry run ruff check .
          poetry run ruff format --check .

      - name: Run tests with coverage
        run: poetry run pytest --cov=src --cov-report=xml

      - name: SAST Scan (Bandit)
        run: poetry run bandit -r src -ll -q

      - name: Secret Scanning (Gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}