e8cr-squad/.github/workflows/ci.yml at e63cbb0f89bfd5f2262e25c623aac2021c43e0e5 · RADobson/e8cr-squad · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  smoke-test:
    name: Demo Pipeline Smoke Test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.11", "3.12"]

    steps:
      - uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Run unified assessment (demo mode)
        run: python3 run_all.py --demo --output /tmp/e8cr-test

      - name: Verify all reports generated
        run: |
          test -f /tmp/e8cr-test/e8cr-assessment.html
          test -f /tmp/e8cr-test/vmpm/evidence-pack/weekly-report.html
          test -f /tmp/e8cr-test/identity/identity-report.html
          test -f /tmp/e8cr-test/appcontrol/appcontrol-report.html
          test -f /tmp/e8cr-test/backup/backup-report.html
          echo "✅ All 5 reports generated successfully"

      - name: Verify individual bot demos
        run: |
          python3 e8cr-vmpm/scripts/demo_generate.py --output /tmp/e8cr-individual-vmpm --full-pipeline
          echo "✅ vmpm demo_generate passed"
          python3 e8cr-identity/scripts/demo_generate.py --output /tmp/e8cr-individual-identity --full-pipeline
          echo "✅ identity demo_generate passed"
          python3 e8cr-appcontrol/scripts/demo_generate.py --output /tmp/e8cr-individual-appcontrol --full-pipeline
          echo "✅ appcontrol demo_generate passed"
          python3 e8cr-backup/scripts/demo_generate.py --output /tmp/e8cr-individual-backup --full-pipeline
          echo "✅ backup demo_generate passed"

      - name: Validate appcontrol contract + evidence schema
        run: |
          pip install pyyaml jsonschema
          python3 e8cr-appcontrol/scripts/check_contract_consistency.py --root e8cr-appcontrol
          python3 e8cr-appcontrol/scripts/validate_evidence.py --evidence-dir /tmp/e8cr-individual-appcontrol --schemas-dir e8cr-appcontrol/schemas

      - name: Check for common issues
        run: |
          # No __pycache__ in repo
          ! find . -path ./.git -prune -o -name __pycache__ -print | grep -q .
          echo "✅ No __pycache__ in repo"

          # No hardcoded secrets
          ! grep -r "AZURE_CLIENT_SECRET\s*=" --include="*.py" . | grep -v "os.environ\|os.getenv\|get_env\|argparse\|#\|sample\|example\|demo"
          echo "✅ No hardcoded secrets detected"

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install ruff
      - run: ruff check --select E,F,W --ignore E501,E402 .