Create ci.yml

.github/workflows/ci.yml

@@ -0,0 +1,100 @@
+name: CI
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+permissions:
+  contents: read
+
+jobs:
+  test-and-secure:
+    runs-on: ubuntu-latest
+
+    env:
+      # Safe fallback for CI only (matches your app behavior)
+      ALLOW_DEV_SALT: "true"
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+
+      - name: Cache pip dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/pip
+          key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install pytest ruff bandit pip-audit
+
+      - name: Lint (Ruff)
+        run: |
+          ruff check .
+
+      - name: Format Check (Ruff)
+        run: |
+          ruff format --check .
+
+      - name: Security Scan (Bandit)
+        run: |
+          bandit -r osint_core/ -ll
+
+      - name: Dependency Audit (pip-audit)
+        run: |
+          pip-audit
+
+      - name: Run Tests (Pytest)
+        run: |
+          pytest -v --tb=short
+
+  drift-guard:
+    runs-on: ubuntu-latest
+    needs: test-and-secure
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Verify critical files exist
+        run: |
+          test -f osint_core/intent.py
+          test -f osint_core/policy.py
+          test -f osint_core/validators.py
+
+      - name: Prevent forbidden tools from entering repo
+        run: |
+          if grep -R -E "nmap|masscan|sqlmap|metasploit" .; then
+            echo "❌ Forbidden tooling detected"
+            exit 1
+          fi
+
+      - name: Enforce passive-first invariant
+        run: |
+          if grep -R "requests.get(" osint_core/ | grep -v "authorized"; then
+            echo "⚠️ Potential unauthorized outbound request"
+            exit 1
+          fi
+
+      - name: Validate YAML integrity
+        run: |
+          python -c "import yaml, sys; yaml.safe_load(open('data/sources.yaml'))"
+
+      - name: Check for raw indicator leakage
+        run: |
+          if grep -R -E "example\.com|@gmail\.com|192\.168\." osint_core/; then
+            echo "⚠️ Possible raw indicator leakage"
+            exit 1
+          fi