ci: test Python 3.13, check migrations, schema, deploy and audit

- Matrix 3.10-3.13; pip cache keyed on the requirements.
- New steps: makemigrations --check, spectacular --validate
  --fail-on-warn, check --deploy --fail-level ERROR, pip-audit of the
  installed environment (the Django 4.2.30 advisories are ignored until
  the Django 5.2 upgrade), and a Docker image build.
- The separate vrtManager unittest run is dropped; manage.py test
  already runs those tests.
- CodeQL also runs on pull requests to master.
- Docker installs into a plain venv instead of using the distro's
  python3-lxml and python3-libvirt; lxml>=6.1, since the distro's
  lxml 5.2.1 has CVE-2026-41066.
- dev requirements add ruff and pip-audit.

.github/workflows/codeql-analysis.yml

@@ -9,7 +9,7 @@ on:
   push:
     branches: [master]
   pull_request:
-    branches-ignore: [master]
+    branches: [master]
   schedule:
     - cron: '0 21 * * 3'
 

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3.11', '3.12']
+        python-version: ['3.10', '3.11', '3.12', '3.13']
 
     steps:
       - name: Checkout Code
@@ -24,8 +24,11 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
-          cache-dependency-path: 'conf/requirements.txt'
+          cache-dependency-path: |
+            conf/requirements.txt
+            dev/requirements.txt
 
+      # Build headers for the sdist-only bindings (libvirt-python, python-ldap)
       - name: Install System Dependencies
         run: |
           sudo apt-get update -qq
@@ -33,19 +36,13 @@ jobs:
             libvirt-dev \
             libldap2-dev \
             libsasl2-dev \
-            python3-lxml \
-            zlib1g-dev \
-            libxslt1-dev \
             pkg-config \
-            gcc \
-            libssl-dev \
-            libxml2-dev
+            gcc
 
       - name: Install Python Dependencies
         run: |
-          python -m pip install --upgrade pip setuptools wheel
-          pip install -r conf/requirements.txt
-          if [ -f dev/requirements.txt ]; then pip install -r dev/requirements.txt; fi
+          python -m pip install --upgrade pip setuptools
+          pip install -r dev/requirements.txt
 
       - name: Configure WebVirtCloud Settings
         run: |
@@ -53,14 +50,44 @@ jobs:
           SECRET_KEY=$(python -c 'import secrets; print(secrets.token_urlsafe(50))')
           sed -i "s|^SECRET_KEY = .*|SECRET_KEY = \"${SECRET_KEY}\"|" webvirtcloud/settings.py
 
+      - name: Check For Missing Migrations
+        run: python manage.py makemigrations --check --dry-run
+
       - name: Run Django Migrations
-        run: |
-          python manage.py migrate --noinput
+        run: python manage.py migrate --noinput
 
-      - name: Run Django Test Suite
-        run: |
-          python manage.py test
+      # Includes the vrtManager tests
+      - name: Run Test Suite
+        run: python manage.py test
 
-      - name: Run vrtManager Unit Tests
+      - name: Validate OpenAPI Schema
+        run: python manage.py spectacular --validate --fail-on-warn --file /dev/null
+
+      # Security warnings (HSTS, secure cookies) depend on the deployment;
+      # gate on errors only.
+      - name: Deployment Checks
+        run: python manage.py check --deploy --fail-level ERROR
+
+      # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17.
+      # Remove them with the Django 5.2 upgrade.
+      - name: Audit Installed Packages
         run: |
-          python -m unittest discover -s vrtManager -p "test_*.py"
+          pip-audit \
+            --ignore-vuln PYSEC-2026-198 \
+            --ignore-vuln PYSEC-2026-199 \
+            --ignore-vuln PYSEC-2026-201 \
+            --ignore-vuln PYSEC-2026-2090 \
+            --ignore-vuln PYSEC-2026-2091 \
+            --ignore-vuln PYSEC-2026-2092 \
+            --ignore-vuln PYSEC-2026-3717 \
+            --ignore-vuln PYSEC-2026-4035
+
+  docker:
+    name: Docker Image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Build Image
+        run: docker build -t webvirtcloud:ci .