pull-request-test.yml

# This workflow check each pull request, overall redundant, but might be useful in some cases

name: Pull request unittest security check

on:
  pull_request:
    branches: [ main ]

env:
  API_KEY: ${{ secrets.API_KEY }}

jobs:
  lint:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3
    - name: Set up Python 3.x
      uses: actions/setup-python@v4
      with:
        python-version: '3.13'
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-lint.txt     
    - name: Run ruff check
      run: ruff check .
    - name: Run black check
      run: black --check .
    - name: Run isort check
      run: isort --check .

  test:
    runs-on: ubuntu-latest
    needs: lint

    strategy:
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
        python-version: [ 3.9, 3.13 ]

    steps:
    - uses: actions/checkout@v3
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v4
      with:
        python-version: ${{ matrix.python-version }}
    - name: Display Python version
      run: python -c "import sys; print(sys.version)"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install pytest pytest-cov
    - name: Run test suite
      run: |
        pytest --cov=api tests/

  bandit-scan:
    runs-on: ubuntu-latest
    needs: test
    steps:
    - uses: actions/checkout@v3
    # Runs a pre configured Bandit scan 
    - name: Run bandit
      uses: jpetrucciani/bandit-check@master
      with:
        # only scans under this path
        path: './api'