ci.yml

name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:

  test:
    name: pytest (${{ matrix.python-version }} / ${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        python-version: ["3.12", "3.13"]
        include:
          - os: windows-latest
            python-version: "3.12"
          - os: windows-latest
            python-version: "3.13"

    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install runtime + dev dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[all,dev]'

      - name: Run unit / integration / security / system tests
        run: python -m pytest tests/unit tests/integration tests/security tests/system -q --maxfail=5

      - name: Quick benchmark smoke-test
        run: stegx benchmark --iterations 1 --size-kib 8

  fips:
    name: FIPS mode round-trip
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Python 3.12
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.12"
          cache: pip

      - name: Install runtime + dev dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[all,dev]'

      - name: Run full test suite under FIPS mode
        env:
          STEGX_FIPS: "1"
        run: python -m pytest tests/unit tests/integration tests/security tests/system -q --maxfail=5

  security-scan:
    name: Security scanners
    runs-on: ubuntu-latest
    env:
      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.12"
          cache: pip

      - name: Install dependencies + security tools
        run: |
          python -m pip install --upgrade pip
          pip install -e '.[all,dev]'
          pip install bandit pip-audit

      - name: Bandit — static analysis report (non-fatal)
        run: bandit -r src/stegx -ll --format json -o bandit-report.json || true

      - name: Bandit — fail on HIGH/CRITICAL
        run: bandit -r src/stegx -ll

      - name: pip-audit — known CVEs in dependencies
        run: |
          pip-audit --strict \
              --requirement requirements.txt \
              --requirement requirements/dev.txt \
              --requirement requirements/extras.txt

      - name: Snyk Code — SAST gate (high/critical)
        if: env.SNYK_TOKEN != ''
        run: |
          pip install --upgrade snyk
          snyk auth "$SNYK_TOKEN"
          snyk code test --severity-threshold=high

      - name: Upload bandit report
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: bandit-report
          path: bandit-report.json
          retention-days: 14

  docker:
    name: Docker image build + scan
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f

      - name: Build StegX image
        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8
        with:
          context: .
          file: Dockerfile
          load: true
          push: false
          tags: stegx:ci
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install Trivy CLI
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
            | sudo sh -s -- -b /usr/local/bin
          trivy --version

      - name: Trivy — CRITICAL/HIGH gate
        run: |
          trivy image \
            --severity CRITICAL,HIGH \
            --ignore-unfixed \
            --exit-code 1 \
            --format table \
            stegx:ci

      - name: Smoke-test the built image
        run: |
          docker run --rm stegx:ci --version
          docker run --rm stegx:ci benchmark --iterations 1 --size-kib 8

  package:
    name: Build sdist + wheel
    runs-on: ubuntu-latest
    needs: test
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
        with:
          python-version: "3.12"
          cache: pip

      - name: Install build + twine
        run: |
          python -m pip install --upgrade pip
          pip install build twine

      - name: Build
        run: python -m build

      - name: Validate distributions
        run: twine check dist/*

      - name: Upload dist artefacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
        with:
          name: stegx-dist
          path: dist/*
          retention-days: 14