blue-team-tools/.github/workflows/sigma-test.yml

# This workflow will install Python dependencies, run tests and lint with a single version of Python
# For more information see: https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: Sigma Rule Tests

on: [push, pull_request, merge_group, workflow_dispatch]

jobs:
  yamllint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: yaml-lint
      uses: ibiqlik/action-yamllint@v3
      with:
        strict: true # fail on warnings as well

  test-sigma-logsource:
    runs-on: ubuntu-latest
    needs: yamllint
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: 3.11
    - name: Test Sigma logsource
      run: |
        pip install PyYAML colorama
        python tests/test_logsource.py

  test-sigma-legacy:
    runs-on: ubuntu-latest
    needs: yamllint
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: 3.11
    - name: Test Sigma Rules
      run: |
        pip install PyYAML colorama
        python tests/test_rules.py

  sigma-check:
    runs-on: ubuntu-latest
    needs: yamllint
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: true
    - name: Set up Python 3.11
      uses: actions/setup-python@v5
      with:
        python-version: 3.11
    - name: Install dependencies
      run: |
        pip install pysigma
        pip install sigma-cli
        pip install pySigma-validators-sigmahq==0.11.*
    - name: Test Sigma Rule Syntax
      run: |
        sigma check --fail-on-error --fail-on-issues --validation-config tests/sigma_cli_conf.yml rules*