ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v6

    - name: Set up Python
      uses: actions/setup-python@v6
      with:
        python-version: '3.11'
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install ruff mypy pytest pytest-mock bandit flask beacon-skill
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
        if [ -f tests/requirements.txt ]; then pip install -r tests/requirements.txt; fi

    - name: Lint (syntax + runtime safety subset)
      run: ruff check tests --select E9,F63,F7,F82

    - name: Type check (core test crypto shim)
      run: mypy tests/mock_crypto.py --ignore-missing-imports

    - name: Security scan (tests)
      run: bandit -r tests --severity-level medium --confidence-level high -c pyproject.toml

    - name: Attestation fuzz regression gate
      env:
        RC_ADMIN_KEY: "0123456789abcdef0123456789abcdef"
        RC_P2P_SECRET: "ci-test-secret-00000000000000000000000000000000"
        DB_PATH: ":memory:"
        ATTEST_FUZZ_CASES: "10000"
      run: python -m pytest tests/test_attestation_fuzz.py -k mutation_regression_no_unhandled_exceptions -v

    - name: Run tests with pytest (blocking)
      env:
        RC_ADMIN_KEY: "0123456789abcdef0123456789abcdef"
        RC_P2P_SECRET: "ci-test-secret-00000000000000000000000000000000"
        DB_PATH: ":memory:"
      run: pytest tests/ -v --ignore=tests/test_epoch_settlement_formal.py --ignore=tests/test_rip201_bucket_spoof.py