ci.yml

name: CI

# Runs on every push and PR so a broken build never reaches main.
# This is the test/lint gate release.yml assumes already passed.

on:
  push:
    branches:
      - main
  pull_request:

permissions:
  contents: read

jobs:
  test:
    name: Test (py${{ matrix.python-version }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.12"]
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install package + dev deps
        run: pip install -e ".[dev]"

      - name: Vendor mermaid.min.js
        # A handful of dashboard tests assert diagrams actually render,
        # which only happens once this ~3.5MB bundle is fetched (see
        # `secfoo vendor mermaid` in cli.py). It lives under ~/.secfoo, not
        # the repo, so a clean checkout -- this CI runner included --
        # doesn't have it until this step fetches it.
        run: secfoo vendor mermaid

      - name: Lint (ruff)
        # Non-blocking for now: 102 pre-existing findings (mostly Optional[X]
        # vs X | None style, plus a few unused test fixtures) predate this
        # workflow. Reporting them here for visibility without turning every
        # unrelated PR red; flip to a hard failure once that backlog is
        # cleared (tracked separately from this CI/CD setup).
        run: ruff check . || true

      - name: Test (secfoo core)
        run: pytest tests

      - name: Runtime probe conformance (reference Python probe, #73)
        run: secfoo sensor conformance -- python -m secfoo.sensor -m secfoo.runtime.conformance.sample_app

      - name: Validate example custom skills
        # Same check a team's own skills repo would run (docs/SKILLS.md).
        run: secfoo skills validate examples/skills