ci.yml

name: CI

on:
  pull_request:
    branches: [ master ]

jobs:
  ansible-syntax:
    runs-on: ubuntu-latest
    name: Ansible Syntax Check

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'

    - name: Install Ansible
      run: |
        python -m pip install --upgrade pip
        pip install ansible ansible-lint

    - name: Install PAN-OS collection
      run: |
        ansible-galaxy collection install paloaltonetworks.panos

    - name: Ansible syntax check
      run: |
        find playbooks -name "*.yml" -exec ansible-playbook --syntax-check {} \;

    - name: Ansible lint
      run: |
        ansible-lint playbooks/

  python-tests:
    runs-on: ubuntu-latest
    name: Python Filter Tests

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.11'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install pytest

    - name: Run custom filter tests
      run: |
        cd filter_plugins
        python -m pytest test_custom_filters.py -v

  secrets-scan:
    runs-on: ubuntu-latest
    name: Secrets Scanning

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Run GitLeaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}