name: TheHarvester Python CI

on:
  push:
    branches:
      - '*'

  pull_request:
    branches:
      - '*'

permissions:
  contents: read

jobs:
  Python:
    runs-on: ${{ matrix.os }}
    strategy:
      max-parallel: 10
      matrix:
        os: [ ubuntu-latest ]
        python-version: [ '3.12', '3.13', '3.14' ]

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit

      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          cache-dependency-glob: "uv.lock"

      - name: Install dependencies
        run: |
          sudo mkdir -p /usr/local/etc/theHarvester
          sudo cp theHarvester/data/*.yaml /usr/local/etc/theHarvester/
          sudo chown -R runner:runner /usr/local/etc/theHarvester/
          uv sync --all-groups --frozen
          echo "$GITHUB_WORKSPACE/.venv/bin" >> $GITHUB_PATH

      - name: Lint with ruff
        uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
        with:
          args: check

      - name: Format with ruff
        uses: astral-sh/ruff-action@278981a28ce3188b1e39527901f38254bf3aac89 # v4.1.0
        with:
          args: format --check

      - name: Test with pytest
        run: |
          pytest
