feat: CI/CD improvements with coverage, bandit, and safety

[sadykovIsmail]

Summary

Splits the single CI job into three focused parallel jobs and adds security scanning + coverage reporting.

CI Jobs

1. Test & Coverage

• Runs the full Django test suite with coverage
• Fails if coverage drops below 80%
• Uploads coverage.xml to Codecov

2. Lint (flake8)

• max-line-length = 100
• Excludes migrations, __pycache__, manage.py, settings.py
• Ignores W503 (conflicts with Black style)

3. Security Scan

• bandit: static analysis for common Python security issues (medium+ severity)
• safety: audits all installed packages against known CVE database

Files Changed

File	Change
.github/workflows/checks.yml	Split into 3 parallel jobs
requirements.dev.txt	Added coverage, bandit, safety
app/.coveragerc	Coverage config with 80% threshold
app/.flake8	Updated max-line-length, ignore list

Test plan

• Push to any branch → all 3 CI jobs run in parallel
• Test with <80% coverage → build fails
• Check Codecov dashboard for coverage report

Closes #9

[Copilot]

Pull request overview

This PR improves the project’s GitHub Actions CI by splitting checks into parallel jobs and adding coverage + security tooling to better enforce quality gates for the Django codebase.

Changes:

• Split the previous combined job into separate Test & Coverage, Lint (flake8), and Security Scan (bandit + safety) jobs.
• Add dev/CI dependencies for coverage and security scanning (coverage, bandit, safety).
• Introduce/adjust tool configuration via .coveragerc and .flake8.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/checks.yml	New CI workflow structure with parallel jobs, coverage generation/upload, and security scans.
requirements.dev.txt	Adds CI/dev tools for coverage and security scanning.
app/.coveragerc	Defines coverage source/omit rules and an 80% minimum threshold.
app/.flake8	Updates flake8 settings (line length, excludes, ignore list).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The Docker Hub login step will fail on pull_request events from forks because secrets (DOCKERHUB_USER/DOCKERHUB_TOKEN) are not provided to forked PRs. Consider guarding this step with an if: that checks secrets are present / PR is from same repo, or remove the login entirely to avoid breaking CI for external contributors.

[Copilot]

coverage run writes its data file (and your coverage xml -o /app/coverage.xml output) into /app, which is a bind mount from the GitHub workspace. Since the container runs as django-user (non-root), it often won’t have write permission to the mounted workspace directory in CI, causing coverage generation to fail. Consider running the coverage commands with a writable COVERAGE_FILE/output dir (e.g., /tmp) and/or running the container with a UID that matches the runner (or as root for this step).

[Copilot]

The workflow passes --source/--omit/--fail-under on the command line even though a .coveragerc was added. Coverage CLI options override config, so the omit list in .coveragerc (e.g., excluding tests) won’t apply, and the workflow and config can easily drift. Prefer relying on .coveragerc (and keep a single source of truth) or update the config to match the CLI and remove the flags here.

Suggested change

	coverage run --source=. --omit='*/migrations/*,manage.py,app/settings.py' \
	manage.py test &&
	coverage report --fail-under=80 &&
	coverage run manage.py test &&
	coverage report &&

[Copilot]

The Bandit exclude paths don’t match this repo’s layout: there is no top-level ./migrations directory (migrations live under app modules like core/migrations). As written, Bandit will still scan migrations (and likely tests), which can add noise/false positives. Adjust --exclude to cover */migrations/* and */tests/* (or the specific app paths) based on the actual tree under /app.

Suggested change

	--exclude ./migrations,./tests \
	--exclude '*/migrations/*,*/tests/*' \

[Copilot]

This step spawns an extra docker compose run just to copy a file, which can also re-trigger dependency containers (e.g., Postgres) and is sensitive to the same UID/permissions issue as the coverage generation. Since /app is already a bind mount, the coverage XML should already exist on the host after the previous step (likely under app/coverage.xml); consider copying it directly on the runner (or writing it to the workspace path in the first place) instead of starting a new container.

Suggested change

	- name: Copy coverage report from container
	if: always()
	run: |
	docker compose run --rm -v ${{ github.workspace }}:/workspace app sh -c \
	"cp /app/coverage.xml /workspace/coverage.xml" || true