Refactor CI workflow for Python with new checks

Author: faresrafat3

.github/workflows/ci.yml

@@ -1,43 +1,39 @@
-name: Python CI
+name: CI
 
 on:
   push:
-    branches: [ "main" ]
+    branches: ["main"]
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
 
 jobs:
-  build:
+  quality:
+    name: Lint / Type / Security / Test
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: ["3.10", "3.11"]
-
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
-    - uses: actions/checkout@v7
-    
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ matrix.python-version }}
-        
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-        pip install ruff pytest
-        
-    - name: Lint with Ruff
-      run: |
-        # Stop the build if there are Python syntax errors or undefined names
-        ruff check . --select=E9,F63,F7,F82 --output-format=github
-        # Default linting (ignoring rule violations to just show warnings)
-        ruff check . --exit-zero
-        
-    - name: Test with pytest
-      run: |
-        if [ -d "tests" ]; then
-          pytest tests/ || echo "No tests found or tests failed - continuing for now"
-        else
-          echo "No tests directory found."
-        fi
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Ruff (lint)
+        run: ruff check .
+
+      - name: Mypy (static type check)
+        run: mypy epistemic_forge
+
+      - name: Bandit (security scan)
+        run: bandit -r epistemic_forge -q --severity-level medium
+
+      - name: Pytest (with coverage)
+        run: pytest --cov=epistemic_forge --cov-report=term-missing --cov-fail-under=70