nac-sanitizer/.github/workflows/test.yml at e31b1bedbe5d7024de8d290dbd854c43fe1d0214 · netascode/nac-sanitizer · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: Tests
on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

jobs:
  security:
    name: Security
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Install bandit
        run: uv tool install bandit[toml]

      - name: Run bandit security scan
        run: bandit -r nac_sanitizer/ -c pyproject.toml -ll -f json -o bandit-security-report.json

      - name: Upload security report
        uses: actions/upload-artifact@v7
        if: always()
        with:
          name: bandit-security-report
          path: bandit-security-report.json

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --group dev

      - name: Check License Headers
        run: bash scripts/license-headers.sh

      - name: Pre-commit Checks
        run: uv run pre-commit run --all-files

  test:
    name: Tests
    runs-on: ubuntu-latest
    timeout-minutes: 10
    strategy:
      matrix:
        python:
          - "3.11"
          - "3.12"
          - "3.13"
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true

      - name: Set up Python
        run: uv python install ${{ matrix.python }}

      - name: Install dependencies and run tests
        run: |
          uv sync --group dev
          uv run pytest --cov --cov-report=xml

      - name: Upload coverage report
        uses: actions/upload-artifact@v7
        if: matrix.python == '3.13'
        with:
          name: coverage-report
          path: coverage.xml