flaskpaste/.gitea/workflows/ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.11"
  PIP_DISABLE_PIP_VERSION_CHECK: "1"
  PIP_NO_CACHE_DIR: "1"

jobs:
  lint:
    name: Lint & Format
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q ruff mypy

      - name: Python syntax check
        run: python -m py_compile run.py wsgi.py app/*.py app/**/*.py

      - name: Ruff lint
        run: ruff check app/ tests/ fpaste

      - name: Ruff format
        run: ruff format --check app/ tests/ fpaste

      - name: Type check
        run: mypy app/ tests/ fpaste --ignore-missing-imports

  security:
    name: Security Scan
    runs-on: ubuntu-latest
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q --upgrade pip
          pip install -q -r requirements.txt
          pip install -q bandit pip-audit

      - name: Bandit security scan (app)
        run: |
          # -ll = medium and high severity only
          bandit -r app/ -ll -q

      - name: Bandit security scan (CLI)
        run: |
          # Scan fpaste CLI for security issues
          bandit fpaste -ll -q

      - name: Check for hardcoded secrets
        run: |
          # Simple pattern check for common secret patterns
          echo "Checking for hardcoded secrets..."
          if grep -rE "(password|secret|api_key|token)\s*=\s*['\"][^'\"]+['\"]" app/ --include="*.py" | grep -v "environ.get\|config\[" | grep -v "test_\|#.*password"; then
            echo "::warning::Potential hardcoded secrets found"
          else
            echo "No hardcoded secrets detected"
          fi

      - name: Dependency audit
        run: |
          # Check for known vulnerabilities in dependencies
          # Fail on high/critical, warn on medium
          pip-audit --progress-spinner=off --strict || {
            echo "::warning::pip-audit found vulnerabilities - review required"
            # Show summary but don't fail CI for now
            pip-audit --progress-spinner=off 2>&1 | tail -20
          }
        continue-on-error: true

  test:
    name: Unit Tests
    runs-on: ubuntu-latest
    needs: [lint]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q pytest pytest-cov

      - name: Run unit tests
        run: |
          pytest tests/test_api.py tests/test_database.py tests/test_mime_detection.py \
                 tests/test_paste_*.py tests/test_metrics.py tests/test_pki.py \
                 -v --tb=short

      - name: Run tests with coverage
        run: |
          pytest tests/ --cov=app --cov-report=term-missing --cov-fail-under=70 || \
            echo "::warning::Coverage below 70%"
        continue-on-error: true

  security-tests:
    name: Security Tests
    runs-on: ubuntu-latest
    needs: [lint, security]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q pytest

      - name: Security header tests
        run: pytest tests/test_security.py -v --tb=short

      - name: Rate limiting tests
        run: pytest tests/test_rate_limiting.py -v --tb=short

      - name: Abuse prevention tests
        run: pytest tests/test_abuse_prevention.py -v --tb=short

      - name: PoW tests
        run: pytest tests/test_pow.py -v --tb=short

      - name: CLI security tests
        run: pytest tests/test_cli_security.py -v --tb=short

      - name: Audit logging tests
        run: pytest tests/test_audit.py -v --tb=short

  security-advanced:
    name: Advanced Security Tests
    runs-on: ubuntu-latest
    needs: [lint, security]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt

      - name: CLI security audit
        run: python tests/security/cli_security_audit.py

      - name: DoS memory exhaustion tests
        run: python tests/security/dos_memory_test.py

      - name: Race condition tests
        run: python tests/security/race_condition_test.py

  memory:
    name: Memory Leak Check
    runs-on: ubuntu-latest
    needs: [lint]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q pytest

      - name: Run memory leak tests
        run: pytest tests/test_memory.py -v --tb=short

  sbom:
    name: SBOM Generation
    runs-on: ubuntu-latest
    needs: [lint]
    container:
      image: python:3.11-slim

    steps:
      - name: Setup and checkout
        run: |
          apt-get update -qq && apt-get install -yqq --no-install-recommends git jq >/dev/null
          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
            "https://oauth2:${{ github.token }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .

      - name: Install dependencies
        run: |
          pip install -q -r requirements.txt
          pip install -q cyclonedx-bom

      - name: Generate SBOM
        run: |
          # Generate CycloneDX SBOM for supply chain transparency
          cyclonedx-py requirements requirements.txt -o sbom.json --of json
          echo "SBOM generated with $(jq '.components | length' sbom.json) components"

      - name: Validate SBOM
        run: |
          # Basic validation - check for expected fields
          if jq -e '.bomFormat == "CycloneDX"' sbom.json >/dev/null; then
            echo "SBOM format: CycloneDX"
            echo "Components: $(jq '.components | length' sbom.json)"
            echo "Spec version: $(jq -r '.specVersion' sbom.json)"
          else
            echo "::warning::SBOM validation failed"
          fi