ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    name: pytest (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install nmap (requis par les tests d'intégration)
        run: sudo apt-get update && sudo apt-get install -y nmap

      - name: Install dépendances Python
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Run pytest avec couverture
        env:
          PRIORITIZER_ENABLED: "0"  # Offline — pas d'appel réseau KEV/EPSS en CI
        run: pytest tests/ -v --tb=short --cov=src --cov-report=term --cov-report=xml --cov-fail-under=80

      - name: Upload coverage XML
        if: matrix.python-version == '3.12'
        uses: actions/upload-artifact@v4
        with:
          name: coverage-xml
          path: coverage.xml
          retention-days: 14

  docker:
    name: docker build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image (sans push)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false
          tags: netaudit:ci
          build-args: |
            BUILD_COMMIT=${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max