YaraFlux MCP Server

name: CI

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: [3.13]
        docker-stage: [builder, development, production]

    steps:
    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
    
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
      with:
        python-version: ${{ matrix.python-version }}
        cache: 'pip'

    - name: Install uv
      run: pip install uv

    - name: Install dependencies
      run: make install

    - name: Instal dev dependencies
      run: make dev-setup

    - name: Format code
      run: make format

    - name: Run linting
      run: make lint

    - name: Run coverage
      run: |
        make coverage

    - name: Build Docker stage
      run: |
        make docker-build

    - name: Test Docker stage
      run: |
        # Test production stage health check
        make docker-test
    - name: Upload coverage reports
      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7  # v5.5.1
      env:
        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

    - name: Upload test results
      if: always()
      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
      with:
        name: test-results-py${{ matrix.python-version }}-${{ matrix.docker-stage }}
        path: |
          htmlcov/**/*
          !htmlcov/**/*.pyc
          !htmlcov/**/__pycache__
          .coverage
        retention-days: 30
        if-no-files-found: warn

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
      
      - name: Set up Python
        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c  # v6.0.0
        with:
          python-version: '3.13'
      
      - name: Install dependencies
        run: make install

      - name: Install dev dependencies
        run: make dev-setup
      
      - name: Run security checks
        run: make security-check