ci.yml

name: CI Pipeline

on: [push, pull_request]

jobs:
  pylint_check:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }}
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install pylint
        run: pip install pylint
      - name: Run pylint
        run: pylint --fail-under=6 --disable=E0401,C0301,C0114,C0411,R0801 **/**/*.py

  safety_check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.x'
      - name: Update pip
        run: pip install --upgrade pip
      - name: Install safety
        run: pip install poetry safety
      - name: Run safety check
        run: safety check

  secrets_scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install truffleHog
        run: pip install truffleHog
      - name: Run truffleHog
        run: trufflehog --regex --entropy=False .

  bandit_check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      - name: Install bandit
        run: pip install bandit
      - name: Run bandit
        run: bandit -lll -r .