cicd.yml

name: CI/CD Pipeline

on:
  push:
    branches-ignore:
      - 'dependabot/**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'

  pull_request:
    branches:
      - '**'
    paths-ignore:
      - '**/*.md'
      - '**/*.cff'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions: read-all

jobs:
  get-python-versions:
    name: Get Python Versions (>= 3.9)
    runs-on: ubuntu-latest
    outputs:
      version-matrix: ${{ steps.get-language-versions.outputs.latest-versions }}

    steps:
      - name: Get Required Versions
        uses: ActionsToolbox/get-language-versions-action@446919617fd774095b5dd3ed71c39dd3fd0d8f4f # v0.1.3
        id: get-language-versions
        with:
          language: "python"
          min-version: 3.9
          remove-patch-version: true

  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Perform ShellCheck Analysis
        run: bash <(curl -s https://raw.githubusercontent.com/CICDToolbox/shellcheck/master/pipeline.sh)

  bandit:
    name: Bandit
    needs: get-python-versions
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false
      matrix:
        python-versions: ${{ fromJson(needs.get-python-versions.outputs.version-matrix) }}

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Python ${{ matrix.python-versions }}
        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
        with:
          python-version: ${{ matrix.python-versions }}

      - name: Perform Bandit Analysis
        run: bash <(curl -s https://raw.githubusercontent.com/CICDToolbox/bandit/master/pipeline.sh)

  cicd-pipeline:
    if: always()
    name: CI/CD Pipeline
    needs:
      - shellcheck
      - bandit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout the Repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2

      - name: Check Job Statuses
        run: .github/scripts/check-jobs.sh '${{ toJson(needs) }}'