ci

Author: EL BADOURI Youssef

.github/workflows/ci.yml

@@ -0,0 +1,121 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, master, develop, feature/** ]
+  pull_request:
+    branches: [ main, master, develop ]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+  secrets:
+    name: Secrets Scan (Gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Scan for secrets
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+
+  backend:
+    name: Backend (Python)
+    runs-on: ubuntu-latest
+    if: ${{ hashFiles('backend/**', 'requirements.txt') != '' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Cache pip
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Install deps
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install ruff pytest pip-audit
+
+      - name: Lint (ruff)
+        working-directory: backend
+        run: ruff check .
+
+      - name: Syntax check
+        run: python -m py_compile $(git ls-files 'backend/**/*.py' 'backend/*.py' || true)
+
+      - name: Unit tests (if any)
+        run: |
+          if [ -d "tests" ] || ls -1 backend | grep -qi "test"; then
+            pytest -q
+          else
+            echo "No tests found — skipping."
+          fi
+
+      - name: Dependency vulnerabilities (pip-audit)
+        run: |
+          pip-audit --requirement requirements.txt || true
+
+  frontend:
+    name: Frontend (Node)
+    runs-on: ubuntu-latest
+    if: ${{ hashFiles('frontend/**', 'frontend/package.json') != '' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install deps
+        working-directory: frontend
+        run: npm ci
+
+      - name: Lint (if script exists)
+        working-directory: frontend
+        run: npm run -s lint || echo "No lint script — skipping."
+
+      - name: Tests (if script exists)
+        working-directory: frontend
+        run: npm test --if-present || echo "No tests — skipping."
+
+      - name: Build (ensures it compiles)
+        working-directory: frontend
+        run: npm run -s build || echo "No build step — skipping."
+
+
+  iac:
+    name: IaC Scan (Checkov)
+    runs-on: ubuntu-latest
+    if: ${{ hashFiles('**/*.tf', '**/*.tfvars', '**/kubernetes/*.y*ml', '**/helm/**') != '' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Checkov
+        uses: bridgecrewio/checkov-action@v12
+        with:
+          quiet: true
+          soft_fail: true  
+
+ 
+  status:
+    name: Status Gate
+    needs: [secrets, backend, frontend]
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "All core checks finished."