test_and_build.yaml

name: CI/CD Pipeline

on:
  push:
    branches:
      - '**'
  pull_request:
    branches:
      - 'develop'

jobs:
  test:
    name: Run Tests
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install -e .[dev]

      - name: Run Tests
        run: pytest -v tests/

  lint:
    name: Lint Code
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install -e .[dev]

      - name: Run Lint
        run: pylint envcloak/
        continue-on-error: true

  security-check:
    name: Security Check
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install -e .[dev]

      - name: Run Bandit
        run: bandit -v -r envcloak/

  build-and-deploy:
    name: Build and Deploy to PyPI
    runs-on: ubuntu-latest
    needs:
      - test
      - lint
      - security-check
    if: >
      (github.ref == 'refs/heads/main') ||
      (github.event_name == 'pull_request' && github.base_ref == 'main')

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v3

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Build Tools
        run: |
          python -m pip install --upgrade pip setuptools wheel
          pip install build twine

      - name: Build Package
        run: python -m build

      - name: Publish to PyPI
        env:
          TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
          TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
        run: twine upload dist/*