Enhance CI/CD: Implement Automated Security Scanning and Testing Pipelines

[ManoharKonala]

Description

Currently, the repository lacks an automated Continuous Integration (CI) pipeline. Even though there is a tests directory for the Python backend, these tests are not run automatically on Pull Requests. Furthermore, there is no automated security scanning for Python code or NPM dependencies.

Proposed Solution

Create a new GitHub Actions workflow (.github/workflows/ci.yml) that will trigger on pushes and pull requests to the main branch. The workflow will:

1. Set up Node.js and Python environments.
2. Install dependencies and run the existing pytest test suite.
3. Run bandit to scan the Python backend (app.py) for security vulnerabilities.
4. Run npm audit to check for insecure Node dependencies.

Expected Behavior

• Developers get immediate feedback on test failures in their PRs.
• Vulnerable code or dependencies are caught automatically before being merged.
• Aligns the project with modern DevOps and DevSecOps standards.

Additional Context

I would love to implement this robust CI pipeline as part of GSSoC 2026. Please assign this issue to me!
Type: DevOps / Security / Testing

[ManoharKonala]

Hi @siddu-k
I am a gssoc'26 contributor and want to contribute on this issue.
Please assign this to me.
Thank you

[ManoharKonala]

Hi @siddu-k
I am a gssoc'26 contributor and want to contribute on this issue.
Please assign this to me.
Thank you