diff --git a/.github/workflows/policy-enforcement.yml b/.github/workflows/policy-enforcement.yml index e53151b..0d47628 100644 --- a/.github/workflows/policy-enforcement.yml +++ b/.github/workflows/policy-enforcement.yml @@ -1,60 +1,30 @@ name: policy-enforcement on: - pull_request: + push: branches: - main - - release/** - push: + paths: + - 'requirements.txt' + - 'SECURITY.md' + - 'LICENSE' + - '.github/workflows/security-checks.yml' + pull_request: branches: - main - -permissions: - contents: read - pull-requests: read - checks: write - -concurrency: - group: policy-${{ github.ref }} - cancel-in-progress: true + schedule: + # Weekly security scan every Monday at 9 AM UTC + - cron: '0 9 * * 1' + workflow_dispatch: jobs: - enforce-policy: - name: policy / enforce + dependency-check: + name: Python Dependency Security Scan runs-on: ubuntu-latest - + steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Validate branch naming - run: | - BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" - echo "Branch: $BRANCH" - - if [[ ! "$BRANCH" =~ ^(main|release\/.+|feature\/.+|bugfix\/.+|hotfix\/.+)$ ]]; then - echo "❌ Invalid branch name" - exit 1 - fi - - - name: Verify signed commits - run: | - git log --format='%G?' origin/main..HEAD | grep -vq '^[GU]$' && { - echo "❌ Unsigned or unverified commits detected" - exit 1 - } || echo "✅ All commits verified" - - - name: Lint configuration files - run: | - yamllint .github || exit 1 - - - name: Dependency vulnerability scan - uses: github/dependency-review-action@v4 - with: - fail-on-severity: high + - name: Checkout code + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - name: CI policy summary - run: | - echo "✅ Policy enforcement passed" + - name: Set up Python + u diff --git a/.github/workflows/scheduled-validation.yml b/.github/workflows/scheduled-validation.yml index 5b9f6a4..0d9f19d 100644 --- a/.github/workflows/scheduled-validation.yml +++ b/.github/workflows/scheduled-validation.yml @@ -1,65 +1,34 @@ -# Simplified workflow - Line 111 error fixed -name: Scheduled Analytics & Validation +name: Scheduled Validation on: schedule: + # Runs at 2 AM UTC every day - cron: '0 2 * * *' workflow_dispatch: + inputs: + validation_type: + description: 'Type of validation to run' + required: false + default: 'full' + type: choice + options: + - full + - quick + - custom + skip_tests: + description: 'Skip test suite' + required: false + default: false + type: boolean jobs: - nightly-validation: - name: Nightly Database Validation + validate: runs-on: ubuntu-latest - - services: - postgres: - image: postgres:15-alpine - env: - POSTGRES_USER: retail_admin - POSTGRES_PASSWORD: validation_password - POSTGRES_DB: retail_analytics_nightly - options: >- - --health-cmd pg_isready - --health-interval 10s - --health-timeout 5s - --health-retries 5 - ports: - - 5432:5432 - steps: - - uses: actions/checkout@v4 - with: - ref: main - - - uses: actions/setup-python@v5 - with: - python-version: '3.11' - cache: 'pip' - - - name: Install dependencies + - name: Checkout code + uses: actions/checkout@v4 + + - name: Determine validation type + id: config run: | - pip install --upgrade pip psycopg2-binary - - - name: Apply schema - env: - PGPASSWORD: validation_password - run: | - psql -h localhost -U retail_admin -d retail_analytics_nightly -f schema/schema.sql -v ON_ERROR_STOP=1 - - - name: Load sample data - env: - PGHOST: localhost - PGUSER: retail_admin - PGPASSWORD: validation_password - PGDATABASE: retail_analytics_nightly - run: | - python scripts/generate_data.py - - - name: Run all queries - env: - PGPASSWORD: validation_password - run: | - for sql_file in queries/*.sql; do - echo "Running: $sql_file" - psql -h localhost -U retail_admin -d retail_analytics_nightly -f "$sql_file" - done + # When triggered by schedule, use 'full' validatio