Audit phase 4l

.github/workflows/ci.yml

@@ -0,0 +1,148 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+
+    - name: Cache pip dependencies
+      uses: actions/cache@v3
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -e ./api
+        pip install pytest-cov
+
+    - name: Create required directories
+      run: mkdir -p api/storage api/logs
+
+    - name: Create admin API key file for tests
+      run: echo "test-ci-key" > api/src/.admin_api_key
+
+    - name: Run tests with coverage
+      run: |
+        cd api
+        python -m pytest --cov=src/zotify_api --cov-report=xml --cov-fail-under=85
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+
+    - name: Install ruff
+      run: python -m pip install ruff
+
+    - name: Run ruff
+      run: python -m ruff check .
+
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: '1.22' # Updated to resolve linter incompatibility
+        cache: false # Disable caching as there are no dependencies
+
+    - name: Run golangci-lint
+      uses: golangci/golangci-lint-action@v4
+      with:
+        # Downgrade to a known stable version to avoid linter/toolchain bugs
+        version: v1.55.2
+        working-directory: snitch
+
+  type-check:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+
+    - name: Cache pip dependencies
+      uses: actions/cache@v3
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -e ./api
+
+    - name: Run mypy
+      run: |
+        cd api
+        python -m mypy --config-file mypy.ini src tests
+
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+
+    - name: Cache pip dependencies
+      uses: actions/cache@v3
+      with:
+        path: ~/.cache/pip
+        key: ${{ runner.os }}-pip-${{ hashFiles('**/pyproject.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-pip-
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -e ./api
+
+    - name: Run bandit
+      run: |
+        cd api
+        python -m bandit -r . -c bandit.yml
+
+    - name: Run safety
+      run: |
+        pip install "safety<3.0.0"
+        python -m safety check --ignore=51167 --ignore=77740
+
+  doc-linter:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 0 # Fetch all history for git diff to work
+
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.12'
+
+    - name: Run documentation linter
+      run: python ${{ github.workspace }}/scripts/lint-docs.py

.gitignore

@@ -154,4 +154,19 @@ Zotify\ Music/
 Zotify\ Podcasts/
 
 # Testing
-debug.py
+debug.py
+
+# Ignore admin API key file
+.admin_api_key
+
+# Ignore snitch binary
+snitch/snitch
+snitch/snitch.exe
+snitch/bin/
+
+# Ignore spotify tokens file
+api/src/storage/spotify_tokens.json
+
+# Ignore API storage directory and database files
+api/storage/
+api/*.db

.pre-commit-config.yaml

@@ -0,0 +1,19 @@
+repos:
+-   repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.1.7
+    hooks:
+    -   id: ruff
+        args: [--fix]
+    -   id: ruff-format
+-   repo: https://github.com/golangci/golangci-lint-pre-commit-hooks
+    rev: v1.55.2
+    hooks:
+    -   id: golangci-lint
+-   repo: local
+    hooks:
+    -   id: doc-linter
+        name: Documentation Linter
+        entry: python scripts/lint-docs.py
+        language: python
+        types: [file] # Run on all staged files
+        pass_filenames: false # The script gets filenames from git, not as arguments

DEPENDENCIES.md

@@ -0,0 +1,24 @@
+# Dependency Management Policy
+
+This document outlines the policy for adding new third-party dependencies to the Zotify API project.
+
+## Guiding Principles
+
+The goal is to maintain a lean, stable, and secure project by minimizing the number of external dependencies. Each new dependency introduces potential security vulnerabilities, maintenance overhead, and licensing complexities.
+
+## Policy for Adding New Dependencies
+
+A new dependency may only be added to the project if it meets all of the following criteria:
+
+1.  **Clear Necessity:** The dependency must provide significant value and solve a problem that cannot be reasonably solved with the existing standard library or current project dependencies.
+2.  **Stability and Maintenance:** The dependency must be widely used, have a stable release (i.e., not in alpha or beta), and be actively maintained by its developers. A strong indicator of active maintenance is recent commit activity and timely responses to issues.
+3.  **License Compatibility:** The dependency's license must be permissive (e.g., MIT, Apache 2.0, BSD) and compatible with the project's overall licensing scheme.
+4.  **Documentation:** The new dependency must be documented in this file, including its name, version, a link to its repository or website, and a brief justification for its inclusion.
+
+## Approval Process
+
+Any new dependency must be explicitly approved during a code review before it can be merged into the main branch.
+
+## Current External Dependencies
+
+*(This section will be populated as new dependencies are added and documented.)*