name: CI

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  lint-and-security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.x"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install ruff bandit

      - name: Run Ruff (linting + formatting check)
        run: |
          ruff check . --output-format=github
          ruff format . --check

      - name: Run Bandit (security scan)
        run: |
          bandit -r . || true