feat: add secure public issue scan bot #6

	name: CI

	on:
	push:
	branches: [main]
	pull_request:

	permissions:
	contents: read

	concurrency:
	group: ci-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	quality:
	name: Quality and security
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: "3.13"
	cache: pip
	- name: Install
	run: python -m pip install --disable-pip-version-check -e ".[dev]"
	- name: Lint
	run: ruff check .
	- name: Format
	run: ruff format --check .
	- name: Types
	run: mypy src
	- name: Security
	run: bandit -r src -ll
	- name: Tests and coverage
	run: pytest --cov --cov-report=term-missing
	- name: Build distributions
	run: python -m build
	- name: Dogfood scanner
	run: wpg scan . --fail-on high

	tests:
	name: Python ${{ matrix.python-version }}
	runs-on: ubuntu-latest
	timeout-minutes: 10
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
	steps:
	- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: ${{ matrix.python-version }}
	cache: pip
	- name: Install
	run: python -m pip install --disable-pip-version-check -e ".[dev]"
	- name: Test
	run: pytest

Navigation Menu