python-static.yml

name: Python static checks

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: python-static-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static-checks:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.13"
          cache: pip
          cache-dependency-path: CryptGuardv2/requirements.txt

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r CryptGuardv2/requirements.txt

      - name: Compile Python sources
        env:
          PYTHONPYCACHEPREFIX: ${{ runner.temp }}/cryptguard-pycache
        run: python -m compileall -q CryptGuardv2

      # Ruff starts as advisory while the application code is professionalized.
      - name: Ruff advisory check
        continue-on-error: true
        shell: bash
        run: |
          if python -m ruff --version >/dev/null 2>&1; then
            python -m ruff check CryptGuardv2
          else
            echo "Ruff is not available; skipping advisory check."
          fi