MCP Multiagent Bridge

name: CI on: push: branches: [ main, develop ] pull_request: branches: [ main ] jobs: security-tests: name: Security Components Test runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Install dependencies run: | python -m pip install --upgrade pip # Core security components don't need external deps - name: Run security test suite run: | python test_security.py - name: Verify critical files run: | # Ensure critical files exist test -f .gitignore || exit 1 test -f yolo_guard.py || exit 1 test -f rate_limiter.py || exit 1 test -f SECURITY.md || exit 1 test -f LICENSE || exit 1 echo "✅ All critical files present" secret-scanning: name: Secret Scanning runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 with: fetch-depth: 0 # Full history for secret scanning - name: Run Gitleaks uses: gitleaks/gitleaks-action@v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} code-quality: name: Code Quality runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Python uses: actions/setup-python@v4 with: python-version: '3.11' - name: Install linting tools run: | python -m pip install --upgrade pip pip install ruff bandit[toml] - name: Run Ruff run: | ruff check . --output-format=github continue-on-error: true - name: Run Bandit security scan run: | bandit -r . -f json -o bandit-report.json || true bandit -r . -f screen continue-on-error: true - name: Upload Bandit results uses: actions/upload-artifact@v4 if: always() with: name: bandit-results path: bandit-report.json all-checks: name: All Checks Passed runs-on: ubuntu-latest needs: [security-tests, secret-scanning, code-quality] steps: - name: Summary run: | echo "🎉 All CI checks passed!" echo "✅ Security tests: passed" echo "✅ Secret scanning: passed" echo "✅ Code quality: passed"