feat: improve jwks cache ttl and rotation handling #19

	name: CI

	on:
	push:
	pull_request:

	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Semgrep (OSS rules)
	uses: semgrep/semgrep-action@v1
	with:
	config: auto
	audit_on: error
	env:
	SEMGREP_SEND_METRICS: "off"

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	python -m pip install -r requirements.txt
	python -m pip install ruff pip-audit cyclonedx-bom
	- name: Lint
	run: ruff check .
	- name: Security audit
	run: pip-audit -r requirements.txt
	- name: Tests
	env:
	OPA_URL: http://localhost:8181
	OCPA_ENV: test
	run: pytest --cov=ocpa --cov-report=term-missing

	- name: Build image
	run: docker build -t ocpa:ci .

	- name: Generate CycloneDX SBOM
	run: cyclonedx-py -r requirements.txt -o cyclonedx.json

	- name: Grype scan (fail on HIGH/CRITICAL)
	uses: anchore/grype-action@v0.4.0
	with:
	fail-build: true
	severity-cutoff: high
	sbom: ./cyclonedx.json

	- name: Install cosign
	uses: sigstore/cosign-installer@v3.6.0
	- name: Sign SBOM (keyless)
	env:
	COSIGN_EXPERIMENTAL: "true"
	run: cosign sign-blob --yes --output-signature cyclonedx.json.sig cyclonedx.json

	- name: Upload security artifacts
	uses: actions/upload-artifact@v4
	with:
	name: security-artifacts
	path: \|
	cyclonedx.json
	cyclonedx.json.sig

Navigation Menu