Security audit: hardening, perf, dep pinning, tests, CI, and refactors

.github/workflows/ci.yml

@@ -0,0 +1,50 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.9", "3.10", "3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements-dev.txt
+
+      - name: Run tests
+        run: pytest tests.py -v
+
+  audit:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install pip-audit
+        run: pip install pip-audit
+
+      - name: Audit declared dependencies for known CVEs
+        run: pip-audit -r requirements.txt --strict

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shawn P (MsShawnP)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -42,18 +42,31 @@ This tool gives you a clear picture in 60 seconds.
 
 ## Run locally
 
+Requires Python 3.9+.
+
 ```bash
 # Clone the repo
-git clone https://github.com/YOUR_USERNAME/gtin-validator.git
+git clone https://github.com/MsShawnP/gtin-validator.git
 cd gtin-validator
 
+# (Optional) create a virtual environment
+python -m venv .venv
+source .venv/bin/activate  # Windows: .venv\Scripts\activate
+
 # Install dependencies
 pip install -r requirements.txt
 
 # Run the app
 streamlit run app.py
 ```
 
+## Run tests
+
+```bash
+pip install -r requirements-dev.txt
+pytest tests.py -v
+```
+
 ## Deploy to Streamlit Community Cloud
 
 1. Push this repo to GitHub
@@ -68,14 +81,17 @@ streamlit run app.py
 
 ```
 gtin-validator/
-├── app.py              # Streamlit UI
-├── gtin_core.py        # Validation engine, scoring, retailer rules
-├── csv_report.py       # CSV export
-├── pdf_report.py       # Branded PDF report (reportlab)
-├── sample_data.py      # Realistic sample data
-├── requirements.txt
+├── app.py                  # Streamlit UI
+├── gtin_core.py            # Validation engine, scoring, retailer rules
+├── csv_report.py           # CSV export
+├── pdf_report.py           # Branded PDF report (reportlab)
+├── sample_data.py          # Realistic sample data
+├── tests.py                # pytest suite
+├── requirements.txt        # Runtime dependencies
+├── requirements-dev.txt    # Test/development dependencies
+├── LICENSE                 # MIT
 ├── .streamlit/
-│   └── config.toml     # Theme configuration
+│   └── config.toml         # Theme configuration
 └── README.md
 ```
 
@@ -102,4 +118,4 @@ MIT
 
 ---
 
-*Built as a portfolio piece demonstrating product data consulting for specialty food brands. For a comprehensive Product Data Health Audit for your brand, [get in touch](mailto:YOUR_EMAIL).*
+*Built as a portfolio piece demonstrating product data consulting for specialty food brands. For a comprehensive Product Data Health Audit for your brand, [get in touch](mailto:Shawn@lailarallc.com).*