Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
name: CI

on:
push:
branches: [main]
pull_request:

jobs:
ci:
runs-on: ubuntu-latest
timeout-minutes: 3

steps:
- name: Checkout
uses: actions/checkout@v4
Comment on lines +14 to +15

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disable credential persistence to prevent token leakage.

By default, actions/checkout persists the repository's GITHUB_TOKEN in the local Git configuration. This introduces a security risk where the token could be exposed if the Git directory is read by untrusted tools or inadvertently packaged into an artifact. Set persist-credentials: false to mitigate this risk.

🔒️ Proposed fix
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Checkout
uses: actions/checkout@v4
- name: Checkout
uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 14 - 15, Update the actions/checkout
step in the CI workflow to set persist-credentials to false, ensuring the
repository token is not retained in local Git configuration while preserving the
existing checkout behavior.

Source: Linters/SAST tools


- name: Set up Python 3.12
uses: actions/setup-python@v5
with:
python-version: "3.12"
cache: pip

- name: Install package with dev dependencies
run: pip install -e ".[dev]"

- name: Lint
run: ruff check src/ sim/

- name: Format check
run: ruff format --check src/ sim/

- name: Type check
run: pyright src/

- name: Test
run: pytest -v --tb=short --cov=src/cyberhosp --cov-report=xml --cov-report=term tests/

- name: Upload coverage report
uses: actions/upload-artifact@v4
with:
name: coverage-report
path: coverage.xml
if-no-files-found: error
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
# CyberHosp

[![CI](https://github.com/dhedhialy/cyberhosp/actions/workflows/ci.yml/badge.svg)](https://github.com/dhedhialy/cyberhosp/actions/workflows/ci.yml)
[![License: AGPL v3](https://img.shields.io/badge/License-AGPL_v3-blue.svg)](LICENSE)
[![Python 3.12+](https://img.shields.io/badge/python-3.12%2B-blue)](pyproject.toml)
[![Code style: ruff](https://img.shields.io/badge/code%20style-ruff-000000.svg)](https://github.com/astral-sh/ruff)
Expand Down
13 changes: 13 additions & 0 deletions pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ dev = [
"ruff>=0.5.0",
"pytest>=8.0",
"pytest-cov>=5.0",
"pyright>=1.1.0",
]

[tool.ruff]
Expand All @@ -36,3 +37,15 @@ target-version = "py312"

[tool.ruff.lint]
select = ["E", "F", "I", "N", "W", "UP"]

[tool.pyright]
pythonVersion = "3.12"
typeCheckingMode = "basic"
reportUnknownParameterType = false
reportMissingTypeStubs = false

[tool.pytest.ini_options]
testpaths = ["tests"]

[tool.coverage.run]
source = ["cyberhosp"]
1 change: 1 addition & 0 deletions sim/.gitkeep
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@

12 changes: 11 additions & 1 deletion tests/test_integration.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,15 @@
"""Integration layer tests."""

from cyberhosp.integration.base import EHRAdapter, EHRConfig
from cyberhosp.integration.fhir import FHIRAdapter


class TestEHRAdapter:
pass
def test_fhir_adapter_inherits_ehradapter(self) -> None:
config = EHRConfig(
vendor="test",
base_url="https://example.com/fhir",
auth_method="oauth2",
api_version="R4",
)
assert isinstance(FHIRAdapter(config), EHRAdapter)
11 changes: 10 additions & 1 deletion tests/test_monitor.py
Original file line number Diff line number Diff line change
@@ -1,5 +1,14 @@
"""Audit and monitoring tests."""

from cyberhosp.monitor.analyzer import BehaviorAnalyzer
from cyberhosp.monitor.audit import AuditPipeline


class TestAuditPipeline:
pass
def test_audit_pipeline_instantiable(self) -> None:
assert type(AuditPipeline()) is AuditPipeline


class TestBehaviorAnalyzer:
def test_behavior_analyzer_instantiable(self) -> None:
assert type(BehaviorAnalyzer()) is BehaviorAnalyzer