ci.yml

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  python:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install development dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.txt

      - name: Ruff
        run: ruff check .

      - name: Bandit
        run: bandit -c pyproject.toml -r src

      - name: Secret scan
        run: git ls-files -z | xargs -0 detect-secrets-hook --baseline .secrets.baseline

      - name: Dependency audit
        run: pip-audit -r requirements-dev.txt

      - name: GitHub Actions lint
        run: actionlint

      - name: Unit tests
        run: PYTHONPATH=src python -m unittest discover -s tests

      - name: Compile Python files
        run: python -m compileall -q src tests

      - name: Build package
        run: python -m build

      - name: Install built wheel
        run: |
          python -m pip install --force-reinstall dist/*.whl
          codex-bg --help

  zizmor:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.12"

      - name: Install zizmor
        run: python -m pip install zizmor==1.25.0

      - name: GitHub Actions security lint
        run: zizmor --offline .github