ci.yml

name: CI

on:
  push:
    branches: [master, main]
  pull_request:
    branches: [master, main]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pytest pytest-asyncio

      - name: Run tests
        run: |
          python -m pytest tests/ -v --tb=short

      - name: Verify all modules import
        run: |
          python -c "
          modules = [
              'config', 'database', 'logger', 'geo_lookup',
              'services.base', 'services.ssh', 'services.ftp', 'services.telnet',
              'services.smtp', 'services.http', 'services.mysql', 'services.postgres',
              'services.redis', 'services.mongodb', 'services.elasticsearch',
              'services.mssql', 'services.rdp', 'services.vnc', 'services.smb',
              'services.ldap', 'services.snmp', 'services.dns', 'services.sip',
              'services.memcached', 'services.docker_api',
              'web.server', 'web.api', 'web.auth', 'utils.crypto', 'utils.network',
              'utils.capture', 'utils.alerting', 'analysis.report', 'analysis.replay',
          ]
          failed = []
          for m in modules:
              try:
                  __import__(m)
              except Exception as e:
                  failed.append(f'{m}: {e}')
          if failed:
              print('FAILED IMPORTS:')
              for f in failed:
                  print(f'  {f}')
              exit(1)
          print(f'All {len(modules)} modules imported successfully')
          "

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install ruff
        run: pip install ruff

      - name: Check formatting
        run: ruff format --check .
        continue-on-error: true

      - name: Lint
        run: ruff check . --select E,F,W --ignore E501
        continue-on-error: true

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check for hardcoded secrets
        run: |
          # Scan for potential secrets (excluding test files and known fake data)
          FOUND=0
          for pattern in "password\s*=" "secret\s*=" "token\s*=" "api_key\s*="; do
            MATCHES=$(grep -rn "$pattern" --include="*.py" \
              --exclude-dir=tests \
              --exclude="config.py" \
              --exclude="web/api.py" \
              . 2>/dev/null | grep -iv "changeme\|fake\|example\|default\|environ\|hash\|verify\|None\|param\|arg" || true)
            if [ -n "$MATCHES" ]; then
              echo "Potential secret pattern '$pattern':"
              echo "$MATCHES"
              FOUND=1
            fi
          done
          if [ "$FOUND" -eq 1 ]; then
            echo "::warning::Potential hardcoded secrets found - review above"
          else
            echo "No hardcoded secrets detected"
          fi

      - name: Check for dangerous functions
        run: |
          # Check for unsafe patterns
          ISSUES=""
          if grep -rn "eval(" --include="*.py" . 2>/dev/null | grep -v "EVALSHA\|test_\|#"; then
            ISSUES="$ISSUES\neval() usage found"
          fi
          if grep -rn "exec(" --include="*.py" . 2>/dev/null | grep -v "executescript\|execute\|test_\|#"; then
            ISSUES="$ISSUES\nexec() usage found"
          fi
          if grep -rn "pickle\.loads" --include="*.py" . 2>/dev/null; then
            ISSUES="$ISSUES\npickle.loads usage found"
          fi
          if [ -n "$ISSUES" ]; then
            echo "::warning::Potentially unsafe patterns:$ISSUES"
          else
            echo "No unsafe patterns detected"
          fi