python-app.yml

name: Scan, Build, and Test

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions:
  contents: read

jobs:
  securityscan:
    permissions:
      contents: read
      security-events: write
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Security check with Bandit
        uses: PyCQA/bandit-action@8a1b30610f61f3f792fe7556e888c9d7dffa52de
        with:
          severity: "medium"

  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.13"]

    steps:
      # 1. Check out the repository
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # 2. Set up Python environment
      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: ${{ matrix.python-version }}

      # 3. Install Poetry
      - name: Install Poetry
        run: pipx install poetry==1.8.4

      # 4. Cache Poetry dependencies
      - name: Cache Poetry
        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
        with:
          path: |
            ~/.cache/pypoetry
            ~/.local/share/pypoetry
          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
          restore-keys: |
            ${{ runner.os }}-poetry-

      # 5. Install project dependencies using Poetry
      - name: Install dependencies
        run: |
          poetry install

      # 6. Cache test dependencies
      - name: Cache test dependencies
        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-test-${{ hashFiles('**/pyproject.toml') }}
          restore-keys: |
            ${{ runner.os }}-pip-test-

      # 7. Lint with flake8 - Errors
      - name: Lint with flake8 (Errors)
        run: |
          poetry run flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
        continue-on-error: false

      # 8. Lint with flake8 - Warnings
      - name: Lint with flake8 (Warnings)
        run: |
          poetry run flake8 . --count --exit-zero --max-complexity=9 --max-line-length=127 --statistics
        continue-on-error: true

      # 9. Run tests with pytest
      - name: Test with pytest
        run: |
          poetry run pytest --junitxml=reports/junit.xml --cov=graphedexcel --cov-report=xml

      # 10. Upload test coverage to Codecov (Optional)
      - name: Upload results to Codecov
        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: false

      # 11. Upload Test Reports (Optional)
      - name: Upload Test Report
        if: always()
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        with:
          name: dist-${{ matrix.python-version }}-junit-test-report
          path: reports/junit.xml