Merge branch 'master' into feature/multi-agent-coordination-security

Author: Mehranmzn

.github/workflows/ci.yml

@@ -2,73 +2,55 @@ name: CI/CD Pipeline
 
 on:
   pull_request:
-    branches:
-      - master
+    branches: [ master ]
   push:
-    branches:
-      - master
+    branches: [ master ]
+
 
 jobs:
   lint:
     name: Linting & Code Quality
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install ruff black mypy
           pip install -e ".[dev]"
-
       - name: Run Ruff
         run: ruff check src/ tests/ examples/
-
       - name: Run Black
         run: black --check src/ tests/ examples/
-
       - name: Run MyPy
         run: mypy src/
         continue-on-error: true
 
   test:
     name: Unit Tests
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ['3.8', '3.9', '3.10', '3.11']
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
-      - name: Set up Python ${{ matrix.python-version }}
+      - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: ${{ matrix.python-version }}
-
+          python-version: '3.11'
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
-
       - name: Run unit tests
         run: pytest tests/ -v --tb=short
-
       - name: Run tests with coverage
-        if: matrix.python-version == '3.11'
         run: |
           pytest tests/ --cov=src/shieldgents --cov-report=xml --cov-report=term
-
       - name: Upload coverage to Codecov
-        if: matrix.python-version == '3.11'
         uses: codecov/codecov-action@v4
         with:
           file: ./coverage.xml
@@ -77,47 +59,38 @@ jobs:
   integration-tests:
     name: Integration Tests
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install -e ".[dev]"
-
       - name: Run integration tests
         run: pytest tests/ -v -m integration --tb=short
         continue-on-error: true
 
   security-check:
     name: Security Scanning
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
           pip install bandit safety
-
       - name: Run Bandit security scan
         run: bandit -r src/ -f json -o bandit-report.json
         continue-on-error: true
-
       - name: Run Safety check
         run: safety check --json
         continue-on-error: true
@@ -126,29 +99,215 @@ jobs:
     name: Build Package
     runs-on: ubuntu-latest
     needs: [lint, test]
-
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
           python-version: '3.11'
-
       - name: Install build dependencies
         run: |
           python -m pip install --upgrade pip
           pip install build twine
-
       - name: Build package
         run: python -m build
-
       - name: Check package
         run: twine check dist/*
-
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: dist-packages
           path: dist/
+
+  # ------------------------------
+  # Telegram notifications
+  # ------------------------------
+
+  notify-telegram-pr-opened:
+    name: Notify Telegram (PR Opened)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - name: Send Telegram message (PR opened)
+        continue-on-error: true
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          # Check if secrets are set
+          if [ -z "$TG_TOKEN" ] || [ -z "$CHAT_ID" ]; then
+            echo "ERROR: TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID is not set"
+            echo "TG_TOKEN length: ${#TG_TOKEN}"
+            echo "CHAT_ID length: ${#CHAT_ID}"
+            exit 0
+          fi
+
+          set -euo pipefail
+          API_URL="https://api.telegram.org/bot${TG_TOKEN}/sendMessage"
+          MSG="📋 <b>New Pull Request</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          PR: <b>#${PR_NUM}</b> — ${PR_TITLE}
+          Branch: <code>${HEAD_BRANCH}</code> → <code>${BASE_BRANCH}</code>
+          Link: ${PR_URL}
+          Run: ${RUN_URL}"
+
+          HTTP_CODE=$(curl -sS -w "%{http_code}" -o /tmp/resp.json "$API_URL" \
+            -d "chat_id=${CHAT_ID}" \
+            -d "parse_mode=HTML" \
+            -d "disable_web_page_preview=true" \
+            --data-urlencode "text=${MSG}")
+          echo "Telegram response:"; cat /tmp/resp.json; echo; echo "HTTP ${HTTP_CODE}"
+          [ "$HTTP_CODE" = "200" ] || exit 1
+
+  notify-telegram-tests-passed:
+    name: Notify Telegram (Tests Passed)
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    if: ${{ always() && needs.lint.result == 'success' && needs.test.result == 'success' }}
+    steps:
+      - name: Send Telegram message (tests passed)
+        continue-on-error: true
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          SHA: ${{ github.sha }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          # Check if secrets are set
+          if [ -z "$TG_TOKEN" ] || [ -z "$CHAT_ID" ]; then
+            echo "ERROR: TELEGRAM_BOT_TOKEN or TELEGRAM_CHAT_ID is not set"
+            echo "Please add these secrets in GitHub repo Settings -> Secrets and variables -> Actions"
+            echo "TG_TOKEN length: ${#TG_TOKEN}"
+            echo "CHAT_ID length: ${#CHAT_ID}"
+            exit 0
+          fi
+
+          set -euo pipefail
+          API_URL="https://api.telegram.org/bot${TG_TOKEN}/sendMessage"
+
+          # Format message based on event type
+          if [ "$EVENT" = "pull_request" ]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+            PR_TITLE="${{ github.event.pull_request.title }}"
+            PR_URL="${{ github.event.pull_request.html_url }}"
+            MSG="✅ <b>Tests Passed</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          PR: <b>#${PR_NUM}</b> — ${PR_TITLE}
+          Link: ${PR_URL}
+          Run: ${RUN_URL}"
+          else
+            BRANCH="${REF#refs/heads/}"
+            MSG="✅ <b>Tests Passed</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          Branch: <code>${BRANCH}</code>
+          Commit: <code>${SHA:0:7}</code>
+          Run: ${RUN_URL}"
+          fi
+
+          HTTP_CODE=$(curl -sS -w "%{http_code}" -o /tmp/resp.json "$API_URL" \
+            -d "chat_id=${CHAT_ID}" \
+            -d "parse_mode=HTML" \
+            -d "disable_web_page_preview=true" \
+            --data-urlencode "text=${MSG}")
+          echo "Telegram response:"; cat /tmp/resp.json; echo; echo "HTTP ${HTTP_CODE}"
+          [ "$HTTP_CODE" = "200" ] || exit 1
+
+  notify-telegram-tests-failed:
+    name: Notify Telegram (Tests Failed)
+    runs-on: ubuntu-latest
+    needs: [lint, test]
+    if: ${{ always() && (needs.lint.result == 'failure' || needs.test.result == 'failure') }}
+    steps:
+      - name: Send Telegram message (tests failed)
+        continue-on-error: true
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+          REF: ${{ github.ref }}
+          SHA: ${{ github.sha }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          API_URL="https://api.telegram.org/bot${TG_TOKEN}/sendMessage"
+
+          # Format message based on event type
+          if [ "$EVENT" = "pull_request" ]; then
+            PR_NUM="${{ github.event.pull_request.number }}"
+            PR_TITLE="${{ github.event.pull_request.title }}"
+            PR_URL="${{ github.event.pull_request.html_url }}"
+            MSG="❌ <b>Tests Failed</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          PR: <b>#${PR_NUM}</b> — ${PR_TITLE}
+          Link: ${PR_URL}
+          Run: ${RUN_URL}"
+          else
+            BRANCH="${REF#refs/heads/}"
+            MSG="❌ <b>Tests Failed</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          Branch: <code>${BRANCH}</code>
+          Commit: <code>${SHA:0:7}</code>
+          Run: ${RUN_URL}"
+          fi
+
+          HTTP_CODE=$(curl -sS -w "%{http_code}" -o /tmp/resp.json "$API_URL" \
+            -d "chat_id=${CHAT_ID}" \
+            -d "parse_mode=HTML" \
+            -d "disable_web_page_preview=true" \
+            --data-urlencode "text=${MSG}")
+          echo "Telegram response:"; cat /tmp/resp.json; echo; echo "HTTP ${HTTP_CODE}"
+          [ "$HTTP_CODE" = "200" ] || exit 1
+
+  notify-telegram-merged:
+    name: Notify Telegram (PR merged)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request' && github.event.action == 'closed' && github.event.pull_request.merged == true
+    steps:
+      - name: Send Telegram message (merged)
+        continue-on-error: true
+        env:
+          TG_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+          CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.event.pull_request.merged_by.login }}
+          PR_NUM: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          BASE_BRANCH: ${{ github.event.pull_request.base.ref }}
+          HEAD_BRANCH: ${{ github.event.pull_request.head.ref }}
+        run: |
+          set -euo pipefail
+          API_URL="https://api.telegram.org/bot${TG_TOKEN}/sendMessage"
+          MSG="✅ <b>PR Merged</b>
+          Repo: <code>${REPO}</code>
+          By: <b>${ACTOR}</b>
+          PR: <b>#${PR_NUM}</b> — ${PR_TITLE}
+          Branch: <code>${HEAD_BRANCH}</code> → <code>${BASE_BRANCH}</code>
+          Link: ${PR_URL}"
+          HTTP_CODE=$(curl -sS -w "%{http_code}" -o /tmp/resp.json "$API_URL" \
+            -d "chat_id=${CHAT_ID}" \
+            -d "parse_mode=HTML" \
+            -d "disable_web_page_preview=true" \
+            --data-urlencode "text=${MSG}")
+          echo "Telegram response:"; cat /tmp/resp.json; echo; echo "HTTP ${HTTP_CODE}"
+          [ "$HTTP_CODE" = "200" ] || exit 1