ci.yml

name: CI - Django Tests and Linting

# Run on pull requests to main and on pushes to main
on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

# Set minimal permissions for all jobs
permissions:
  contents: read

jobs:
  test:
    name: Run Tests (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    permissions:
      contents: read

    # Test against multiple Python versions
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12']

    env:
      SECRET_KEY: ${{ secrets.SECRET_KEY || 'django-insecure-test-key-for-ci-only-do-not-use-in-production' }}
      DEBUG: 'True'
      ALLOWED_HOSTS: localhost,127.0.0.1

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@v5
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt

    - name: Run Django system checks
      run: |
        python manage.py check

    - name: Run migrations check
      run: |
        python manage.py makemigrations --check --dry-run

    - name: Run tests
      run: |
        python manage.py test

  lint:
    name: Code Quality Checks
    runs-on: ubuntu-latest
    permissions:
      contents: read

    env:
      SECRET_KEY: ${{ secrets.SECRET_KEY || 'django-insecure-test-key-for-ci-only-do-not-use-in-production' }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'
        cache: 'pip'

    - name: Install linting tools
      run: |
        python -m pip install --upgrade pip
        pip install flake8 pylint

    - name: Run flake8
      run: |
        # Stop the build if there are Python syntax errors or undefined names
        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics --exclude=venv,migrations
        # Exit-zero treats all errors as warnings
        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics --exclude=venv,migrations

  security:
    name: Security Checks
    runs-on: ubuntu-latest
    permissions:
      contents: read

    env:
      SECRET_KEY: ${{ secrets.SECRET_KEY || 'django-insecure-test-key-for-ci-only-do-not-use-in-production' }}

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.12'

    - name: Install security tools
      run: |
        python -m pip install --upgrade pip
        pip install bandit safety

    - name: Run bandit security scan
      run: |
        # Scan for common security issues in Python code
        # Exclude test files and fail on medium and high severity issues
        bandit -r study study_platform -ll -f json -o bandit-report.json --exclude '*/tests.py,*/test_*.py'
        bandit -r study study_platform -ll --exclude '*/tests.py,*/test_*.py'

    - name: Check for known vulnerabilities in dependencies
      run: |
        # Check dependencies for known security vulnerabilities
        safety check --json
        safety check