ci.yml

name: CI & Security Pipeline

on:
  push:
    branches: [ main, dev, "feat/*" ]
  pull_request:
    branches: [ main, dev ]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository (full history for secret scanning)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan for leaked secrets (Gitleaks)
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up Python for Security Audits
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Audit Python dependencies for CVEs
        run: |
          python -m pip install pip-audit
          if [ -f requirements.txt ]; then pip-audit -r requirements.txt; fi

      - name: Run Static Code Analysis (Bandit)
        run: |
          python -m pip install bandit
          bandit -r . -x ./.venv,./tests

  test:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          if [ -f requirements-dev.txt ]; then pip install -r requirements-dev.txt; fi

      - name: Run tests with Pytest
        run: |
          pytest

  build:
    needs: [test, security]
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          push: false
          tags: tmp-vault:latest