ci.yml

---
name: CI

on: [merge_group, push, pull_request]

jobs:
  checks:
    runs-on: ubuntu-latest
    container: debian:bookworm
    steps:
      - name: Bootstrap Debian system package dependencies
        run: |
          apt-get update && apt-get install --yes --no-install-recommends make sudo git git-lfs ca-certificates
      - uses: actions/checkout@v4
        with:
          lfs: true
      - name:  Install additional packages and Python dependencies
        run: |
          # Installs Python & bootstrap wheels, and initializes a virtualenv at .venv
          make install-deps
          ./.venv/bin/pip install -r test-requirements.txt
      - name: Run linters
        run: |
          . ./.venv/bin/activate
          make lint
      - name: Run tests except reprotest
        run: |
          . ./.venv/bin/activate
          make test

  checksums:
    runs-on: ubuntu-latest
    container: debian:bookworm
    steps:
      - name: Bootstrap Debian system package dependencies
        run: |
          apt-get update && apt-get install --yes --no-install-recommends make git git-lfs gnupg ca-certificates
      - uses: actions/checkout@v4
        with:
          lfs: true
      - name: Verify checksums and signatures
        run: |
          git config --global --add safe.directory '*'
          ./scripts/verify-sha256sum-signature securedrop-client
          ./scripts/verify-sha256sum-signature securedrop-export
          ./scripts/verify-sha256sum-signature securedrop-log