ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install system dependencies for Qt/PySide6
        run: |
          sudo apt-get update -qq
          sudo apt-get install -y -qq libxcb-cursor0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 libxcb-randr0 libxcb-shape0 libxcb-xfixes0 libxcb-xinerama0 libxcb-xkb1 libxkbcommon-x11-0 libgl1 libegl1 2>&1 || echo "Some system deps may be missing"

      - name: Install Python dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt

      - name: Compile-check Python sources
        run: |
          python -m compileall . -q

      - name: Run update detection regression tests
        run: |
          python tools/test_updater_asset_flow.py

  security:
    name: Security
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install security tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install pip-audit bandit

      - name: Audit dependencies
        run: |
          pip-audit -r requirements.txt

      - name: Run Bandit
        run: |
          bandit -q -r main.py tools