CC-167: cvm-measure TDX measurement toolkit #8

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	lint-and-test:
	runs-on: ubuntu-latest
	steps:
	- uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0
	with:
	egress-policy: audit

	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

	- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
	with:
	python-version: "3.11"

	- name: Install dependencies
	run: pip install -e ".[dev]" bandit pip-audit

	- name: Lint (ruff)
	run: ruff check src/ tests/

	- name: Type check (mypy)
	run: mypy src/

	- name: Security scan (bandit)
	run: bandit -r src/ -f json -o bandit-report.json \|\| true

	- name: Dependency audit (pip-audit)
	run: pip-audit --format=json --output=pip-audit-report.json \|\| true

	- name: Test (pytest)
	run: pytest tests/ -v --tb=short

	- name: Upload security reports
	if: always()
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
	with:
	name: security-reports
	path: \|
	bandit-report.json
	pip-audit-report.json

Provide feedback