This repository was archived by the owner on Jul 16, 2026. It is now read-only.

chore(ci): enhance CI with security scanning #4

	name: Continuous Integration

	on:
	push:
	branches: [ main, master ]
	pull_request:
	branches: [ main, master ]

	jobs:
	frontend:
	name: Frontend (Next.js)
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ./frontend

	steps:
	- uses: actions/checkout@v4

	- name: Use Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '20'
	cache: 'npm'
	cache-dependency-path: './frontend/package-lock.json'

	- name: Install dependencies
	run: npm ci

	- name: Build Next.js
	run: npm run build
	env:
	NEXT_TELEMETRY_DISABLED: 1

	backend:
	name: Backend (Python)
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: ./backend

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: 'pip'

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	if [ -f requirements.txt ]; then pip install -r requirements.txt; fi

	- name: Syntax check
	run: python -m py_compile $(find . -name "*.py" \| head -20) \|\| true

	security_scan:
	name: Security Scan (Trivy)
	needs: [frontend, backend]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	ignore-unfixed: true
	format: 'table'
	exit-code: '0'
	severity: 'CRITICAL,HIGH'

Navigation Menu