ci: add quality + release workflows, pre-commit, docs

mak3r-cyber · mak3r-cyber · commit 35eac253d525 · 2025-11-10T14:25:46.000+01:00
diff --git a/.github/ISSUE_TEMPLATE/bug.md b/.github/ISSUE_TEMPLATE/bug.md
@@ -0,0 +1,6 @@
+name: Bug
+body:
+- type: textarea
+  attributes: {label: Steps to reproduce}
+- type: input
+  attributes: {label: SHA/Tag}
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,5 @@
+## Objective
+## Test plan
+## Checklist
+- [ ] Lint/Type checks pass
+- [ ] CI green
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: ci
+on:
+  push:
+    branches: [main]
+  pull_request:
+jobs:
+  qa:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with: {python-version: '3.11'}
+    - run: python -m pip install -U pip && pip install ruff black mypy pandas openpyxl
+    - run: ruff check .
+    - run: black --check .
+    - run: mypy src
+  build-artifacts:
+    needs: qa
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with: {python-version: '3.11'}
+    - run: pip install pandas openpyxl
+    - run: python tools/csv2xlsx.py
+    - uses: actions/upload-artifact@v4
+      with:
+        name: risk-matrix-xlsx
+        path: docs/reports/risk_matrix.xlsx
+  security:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - run: bash tools/sec_checks.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,19 @@
+name: release
+on:
+  workflow_dispatch:
+    inputs:
+      tag: {description: 'vX.Y.Z', required: true}
+jobs:
+  cut:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/download-artifact@v4
+      with: {name: risk-matrix-xlsx, path: dist/}
+    - name: Create release
+      uses: softprops/action-gh-release@v2
+      with:
+        tag_name: ${{ github.event.inputs.tag }}
+        files: dist/risk_matrix.xlsx
+        generate_release_notes: true
+      env: { GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} }
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -0,0 +1,13 @@
+repos:
+- repo: https://github.com/psf/black
+  rev: 24.8.0
+  hooks: [{id: black}]
+- repo: https://github.com/astral-sh/ruff-pre-commit
+  rev: v0.6.0
+  hooks: [{id: ruff}]
+- repo: https://github.com/pre-commit/mirrors-mypy
+  rev: v1.11.2
+  hooks: [{id: mypy}]
+- repo: https://github.com/pypa/pip-audit
+  rev: v2.7.3
+  hooks: [{id: pip-audit}]
diff --git a/CODEOWNERS b/CODEOWNERS
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -1,19 +1 @@
-# Contributing
-
-Scope: educational, synthetic data only. One PR = one change.
-
-## Workflow
-- Fork then create a feature branch
-- Keep changes small and auditable
-- Update docs/tests when relevant
-
-## Coding & content
-- English only
-- No patient data
-- CSV is the source of truth for the risk matrix
-
-## Commit messages
-Conventional commits (feat|fix|docs|refactor|test|ci|chore): short, imperative.
-
-## Governance
-Maintainers: kamilia meliani / lazreg meliani.
+Dev quickstart, pre-commit, CI rules, commit style: Conventional Commits.
diff --git a/SECURITY.md b/SECURITY.md
@@ -1,11 +1 @@
-# Security Policy
-
-## Supported
-This repository is educational. No production systems.
-
-## Reporting a vulnerability
-Please open a private disclosure via GitHub Security Advisories
-or contact the maintainers on LinkedIn. Do not post PII, PHI, or patient data.
-
-## Scope
-Only issues in this repo. No device or vendor bug-bounty here.
+Report security issues via GitHub Security tab. No exploits in issues.
diff --git a/docs/architecture/ADR-0001-scope.md b/docs/architecture/ADR-0001-scope.md
@@ -0,0 +1,2 @@
+# ADR-0001 Scope
+Decision: risk matrix generation + CI artifacts to support GRC/detection/pentest-light demo.
diff --git a/docs/compliance/mapping.md b/docs/compliance/mapping.md
@@ -0,0 +1,6 @@
+| Exigence | Preuve repo |
+|----------|-------------|
+| Gestion risques | risk_matrix.xlsx en release + CI |
+| Sécurité dev | CI qualité + protection branche |
+| Gestion vulnérabilités | SBOM + Trivy dans CI |
+| Traçabilité | Releases taguées + artifacts |
diff --git a/pyproject.toml b/pyproject.toml
@@ -0,0 +1,11 @@
+[tool.black]
+line-length = 100
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+mypy_path = "src"
diff --git a/src/skadia_iomt/__init__.py b/src/skadia_iomt/__init__.py
diff --git a/tools/csv2xlsx.py b/tools/csv2xlsx.py
@@ -1,6 +1,9 @@
-import pathlib, pandas as pd
+import pathlib
+import pandas as pd
+
 src = pathlib.Path("02-Matrices/risk_matrix.csv")
-dst_dir = pathlib.Path("docs/reports"); dst_dir.mkdir(parents=True, exist_ok=True)
+dst_dir = pathlib.Path("docs/reports")
+dst_dir.mkdir(parents=True, exist_ok=True)
 dst = dst_dir / "risk_matrix.xlsx"
 pd.read_csv(src).to_excel(dst, index=False, sheet_name="RiskMatrix")
 print(f"Wrote {dst}")
diff --git a/tools/demo.sh b/tools/demo.sh
@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+python3 - <<'PY'
+import pandas as pd; df=pd.read_csv("data/risk_matrix.csv"); print(df.head())
+PY
diff --git a/tools/sec_checks.sh b/tools/sec_checks.sh
@@ -0,0 +1,2 @@
+syft packages dir:. -o spdx-json=sbom.spdx.json
+trivy fs --exit-code 1 --format table .

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+# ADR-0001 Scope`
	`2`	`+Decision: risk matrix generation + CI artifacts to support GRC/detection/pentest-light demo.`