From 82cce2da013389b6f3da9fa4483e8e65dbf3501f Mon Sep 17 00:00:00 2001 From: Shadowwalker Date: Tue, 23 Dec 2025 06:20:18 +0000 Subject: [PATCH] Enhance CI with Bandit and coverage checks Added Bandit security scan and coverage check steps. --- .github/workflows/tests.yml | 93 +++++++++++++++++++------------------ 1 file changed, 49 insertions(+), 44 deletions(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 386b0aa..02b3b43 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -1,5 +1,4 @@ name: Tests and Linting - on: push: branches: [ main ] @@ -12,48 +11,54 @@ on: strategy: matrix: python-version: ['3.8', '3.9', '3.10', '3.11'] - steps: - - uses: actions/checkout@v3 - + - uses: actions/checkout@v3 - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v4 - with: - python-version: ${{ matrix.python-version }} - - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install pytest pytest-cov flake8 - if [ -f requirements.txt ]; then pip install -r requirements.txt; fi - - - name: Lint with flake8 - run: | - # Stop the build if there are Python syntax errors or undefined names - flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics - # Exit-zero treats all errors as warnings - flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics - continue-on-error: true - - - name: Run tests with pytest - run: | - pytest --cov=. --cov-report=xml --cov-report=term-missing - continue-on-error: true - - - name: Upload coverage reports - uses: codecov/codecov-action@v3 - with: - file: ./coverage.xml - fail_ci_if_error: false - continue-on-error: true - - security: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - - name: Run Bandit security scan - run: | - pip install bandit - bandit -r . -f json -o bandit-report.json - continue-on-error: true + uses: actions/setup-python@v4 + with: + python-version: ${{ matrix.python-version }} + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install pytest pytest-cov flake8 bandit + if [ -f requirements.txt ]; then pip install -r requirements.txt; fi + - name: Lint with flake8 + run: | + # Stop the build if there are Python syntax errors or undefined names + flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics + # Exit-zero treats all errors as warnings + flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics + - name: Run tests with pytest + run: | + pytest --cov=. --cov-report=xml --cov-report=term-missing + - name: Check coverage threshold + run: | + coverage report --fail-under=70 + - name: Upload coverage reports + if: always() + uses: codecov/codecov-action@v3 + with: + file: ./coverage.xml + fail_ci_if_error: true + + security: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.10' + - name: Install Bandit + run: pip install bandit + - name: Run Bandit security scan + run: | + bandit -r . -f json -o bandit-report.json + bandit -r . -f txt + - name: Upload Bandit report + if: always() + uses: actions/upload-artifact@v3 + with: + name: bandit-security-report + path: bandit-report.json +