python-app.yml

# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python

name: Dynamic Code Analysis

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions:
  contents: read

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: "3.11"
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install crosshair-tool
        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
    - name: Crosshair analysis
      run: |
        # Sources moved from ./component-library to ./src in the repo
        # reorganization. `crosshair watch` never exits (it would hang the
        # job); use `check` and run advisory so exploratory findings on
        # third-party-shaped code don't block PRs.
        crosshair check ./src || true