| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| security-scan: | |
| name: Security & Lint | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.x" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ] && [ -s requirements.txt ]; then | |
| pip install -r requirements.txt | |
| fi | |
| - name: Check for secrets in code | |
| uses: trufflesecurity/trufflehog@v3.96.0 | |
| with: | |
| extra_args: --only-verified | |
| - name: Validate HTML | |
| run: | | |
| pip install html5validator | |
| find . -name "*.html" -not -path "./.git/*" | xargs -r html5validator --also-check-css || true | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |