e8cr-squad/.github/workflows/ci.yml at c9015a73a613bf15c52eeb109fb0badc7df71cc4 · RADobson/e8cr-squad · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  smoke-test:
    name: Demo Pipeline Smoke Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Run unified assessment (demo mode)
        run: python3 run_all.py --demo --output /tmp/e8cr-test

      - name: Verify all reports generated
        run: |
          test -f /tmp/e8cr-test/e8cr-assessment.html
          test -f /tmp/e8cr-test/vmpm/evidence-pack/weekly-report.html
          test -f /tmp/e8cr-test/identity/identity-report.html
          test -f /tmp/e8cr-test/appcontrol/appcontrol-report.html
          test -f /tmp/e8cr-test/backup/backup-report.html
          test -f /tmp/e8cr-test/edr/edr-report.html
          echo "✅ All 6 reports generated successfully"

      - name: Verify individual bot demos
        run: |
          for bot in vmpm identity appcontrol backup; do
            python3 $bot/scripts/demo_generate.py --output /tmp/e8cr-individual-$bot --full-pipeline
            echo "✅ $bot demo_generate passed"
          done
          python3 e8cr-edr/scripts/demo_generate.py --output-dir /tmp/e8cr-individual-edr
          echo "✅ edr demo_generate passed"

      - name: Check for common issues
        run: |
          # No __pycache__ in repo
          ! find . -path ./.git -prune -o -name __pycache__ -print | grep -q .
          echo "✅ No __pycache__ in repo"

          # No hardcoded secrets
          ! grep -r "AZURE_CLIENT_SECRET\s*=" --include="*.py" . | grep -v "os.environ\|os.getenv\|get_env\|argparse\|#\|sample\|example\|demo"
          echo "✅ No hardcoded secrets detected"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install ruff
      - run: ruff check --select E,F,W --ignore E501,E402,W503 .