ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    name: Tests & coverage (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.12"]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install test dependencies
        run: pip install pytest pytest-cov flask asn1tools xmltodict prometheus_client
      - name: Event Publisher tests (>=80% coverage)
        run: pytest deployment/eventPublisher/tests --cov=EventPublisher --cov=config --cov-report=term-missing --cov-fail-under=80
        env:
          PYTHONPATH: deployment/eventPublisher
      - name: Kafka speed exporter tests (>=80% coverage)
        run: pytest deployment/kafka_speed_exporter/tests --cov=kafka_speed_exporter --cov-report=term-missing --cov-fail-under=80
        env:
          PYTHONPATH: deployment/kafka_speed_exporter
      - name: NiFi scripts tests (>=80% coverage)
        run: pytest deployment/nifi/nifi-scripts --cov=src --cov-report=term-missing --cov-fail-under=80
        env:
          PYTHONPATH: deployment/nifi/nifi-scripts

  lint:
    name: Lint (ruff)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - run: pip install ruff
      - name: ruff check (warnings fail the build)
        run: ruff check deployment/eventPublisher deployment/kafka_speed_exporter deployment/nifi/nifi-scripts --config deployment/nifi/nifi-scripts/pyproject.toml

  sast:
    name: SAST (bandit)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Required to publish the SARIF results as code scanning alerts.
      security-events: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      # sarif: SARIF report format. toml: parser for the pyproject.toml config on
      # Python < 3.11 (3.11+ uses the stdlib tomllib). Without it bandit exits 2
      # and writes an empty report.
      - run: pip install 'bandit[sarif,toml]'
      - name: Run bandit
        id: bandit
        run: |
          set +e
          bandit -r deployment/eventPublisher deployment/kafka_speed_exporter deployment/nifi/nifi-scripts/src \
            -c deployment/nifi/nifi-scripts/pyproject.toml \
            -f sarif -o bandit.sarif
          code=$?
          set -e
          # 0 = clean, 1 = findings, >= 2 = bandit itself failed. Findings must not
          # abort the job before the SARIF upload, but a tool error must — the
          # report it leaves behind is empty and would wipe the existing alerts.
          if [ "$code" -ge 2 ]; then
            echo "::error::bandit exited $code (configuration or runtime error)"
            exit "$code"
          fi
          echo "findings=$code" >> "$GITHUB_OUTPUT"
      # Pull requests from forks run with a read-only GITHUB_TOKEN, so the upload
      # is skipped there. The pass/fail gate below still blocks such a PR.
      - name: Upload bandit SARIF
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: bandit.sarif
          # Distinct from the CodeQL categories; without it this upload would
          # replace the CodeQL results for the same commit.
          category: bandit
      - name: Fail the build if bandit found issues
        if: steps.bandit.outputs.findings == '1'
        run: exit 1

  poetry-lock:
    name: Poetry lock is resolvable & current
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - run: pipx install 'poetry>=2.0,<3.0'
      # An unresolvable pyproject.toml leaves GitHub's dependency graph "Degraded",
      # which silently disables Dependabot alerts for this directory. Fail the PR instead.
      - name: Verify poetry.lock matches pyproject.toml
        run: poetry check --lock
        working-directory: deployment/nifi/nifi-scripts

  dco:
    name: DCO sign-off
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Verify every commit has a Signed-off-by line
        run: |
          base="${{ github.event.pull_request.base.sha }}"
          head="${{ github.event.pull_request.head.sha }}"
          missing=0
          for c in $(git rev-list "$base".."$head"); do
            if ! git show -s --format=%B "$c" | grep -qiE '^Signed-off-by: .+ <.+@.+>'; then
              echo "::error::Commit $c is missing a 'Signed-off-by' line. Use 'git commit -s' (see CONTRIBUTING.md)."
              missing=1
            fi
          done
          [ "$missing" -eq 0 ] || exit 1