Merge pull request #78 from red-hat-data-services/ray-rag-pipeline #346

	name: Code Quality and Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	workflow_dispatch: # Allows manual triggering from GitHub UI

	jobs:
	linting-and-formatting:
	name: Linting and Formatting
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'

	- name: Install Ruff
	run: pip install ruff==0.14.4

	- name: Run Ruff linter
	run: ruff check . --output-format=github

	- name: Run Ruff formatter check
	run: ruff format --check .

	- name: Run Markdownlint
	uses: nosborn/github-action-markdown-cli@v3.4.0
	with:
	files: .
	config_file: .markdownlint.json
	ignore_files: .gitignore

	secret-scanning:
	name: Secret Scanning
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Install Gitleaks
	run: \|
	GITLEAKS_VERSION=8.29.0
	curl -sSL https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz \
	\| tar -xz gitleaks
	sudo mv gitleaks /usr/local/bin/gitleaks

	- name: Run Gitleaks
	run: gitleaks detect --source . --config .gitleaks.toml --no-banner

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'

	- name: Run Talisman
	uses: carhartl/talisman-secrets-scan-action@v1.3.0
	continue-on-error: true
	if: github.event_name == 'pull_request'
	with:
	local-ref: ${{ github.event.pull_request.head.sha }}
	remote-ref: origin/${{ github.event.pull_request.base.ref }}

Provide feedback