Tests

feat: integrate hatch-vcs for git-tag-driven versioning #105

	name: Tests
	on:
	workflow_dispatch:
	pull_request:
	push:
	branches:
	- main

	jobs:
	security:
	name: Security
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Install uv
	uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true

	- name: Install bandit
	run: uv tool install bandit[toml]

	- name: Run bandit security scan
	run: bandit -r nac_sanitizer/ -c pyproject.toml -ll -f json -o bandit-security-report.json

	- name: Upload security report
	uses: actions/upload-artifact@v7
	if: always()
	with:
	name: bandit-security-report
	path: bandit-security-report.json

	lint:
	name: Lint
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Install uv
	uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true

	- name: Set up Python
	run: uv python install 3.13

	- name: Install dependencies
	run: uv sync --group dev

	- name: Check License Headers
	run: bash scripts/license-headers.sh

	- name: Pre-commit Checks
	run: uv run pre-commit run --all-files

	test:
	name: Tests
	runs-on: ubuntu-latest
	timeout-minutes: 10
	strategy:
	matrix:
	python:
	- "3.11"
	- "3.12"
	- "3.13"
	steps:
	- name: Checkout
	uses: actions/checkout@v7

	- name: Install uv
	uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true

	- name: Set up Python
	run: uv python install ${{ matrix.python }}

	- name: Install dependencies and run tests
	run: \|
	uv sync --group dev
	uv run pytest --cov --cov-report=xml

	- name: Upload coverage report
	uses: actions/upload-artifact@v7
	if: matrix.python == '3.13'
	with:
	name: coverage-report
	path: coverage.xml

Provide feedback