agentops.yml

name: AgentOps Security Quality Gate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: '17 7 * * 1'

permissions:
  contents: read
  security-events: write
  actions: read

concurrency:
  group: agentops-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  python-quality:
    name: Python lint, test, package smoke
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.11', '3.12']
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip

      - name: Install package with dev extras
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e '.[dev]'
          python -m pip install build pip-audit bandit[toml]

      - name: Ruff lint
        run: ruff check . --output-format=github

      - name: Ruff format check
        run: ruff format --check .

      - name: Unit and integration tests
        run: pytest

      - name: Build package
        run: python -m build

      - name: Dependency vulnerability audit
        run: pip-audit --skip-editable

      - name: Static security scan
        run: bandit -r src -ll

  repo-hygiene:
    name: Repository hygiene scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Gitleaks
        run: |
          GITLEAKS_VERSION="8.30.1"
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz
          sudo mv gitleaks /usr/local/bin/gitleaks
          gitleaks version

      - name: Secret pattern scan
        run: |
          gitleaks git . \
            --verbose \
            --redact

      - name: Generate status summary
        shell: bash
        run: |
          {
            echo '## AgentOps Quality Gate'
            echo
            echo '- Repository: `${{ github.repository }}`'
            echo '- Ref: `${{ github.ref }}`'
            echo '- Actor: `${{ github.actor }}`'
            echo '- Commit: `${{ github.sha }}`'
            echo
            echo '### Controls'
            echo '- Ruff lint and format check'
            echo '- Pytest execution'
            echo '- Package build smoke test'
            echo '- pip-audit dependency scan'
            echo '- Bandit static security scan'
            echo '- Gitleaks secret scan'
          } >> "$GITHUB_STEP_SUMMARY"