ci.yaml

name: CI

on:
  push:
    branches:
      - main
  pull_request:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install Poetry
        run: pip install poetry

      - name: Install dependencies
        run: |
          npm install
          poetry config virtualenvs.create false
          poetry install --no-root --no-interaction --no-ansi
          scripts/fix_mermaid_dompurify.sh

      - name: Run Ruff
        run: poetry run ruff check --output-format=github .

      - name: Run MyPy
        run: poetry run mypy ai_security_analyzer

      - name: Test with pytest
        run: poetry run pytest -m "not integration"

      - name: Security check with Bandit
        run: poetry run bandit -r . --severity-level high

      - name: Dockerfile linter
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: Dockerfile

      - name: Test docker
        run: |
          docker build . -t test-ai-security-analyzer
          docker run test-ai-security-analyzer -h