name: detections

on:

  push:

    branches: [main]

  pull_request:

    branches: [main]

  workflow_dispatch:

permissions:

  contents: read

jobs:

  validate:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5

        with:

          python-version: "3.11"

      - run: pip install -r requirements.txt

      - name: Lint Sigma rules

        run: sigma check rules/

      - name: Schema + ATT&CK tests

        run: pytest -q

      - name: Convert to Splunk / Elastic / Sentinel

        run: python tools/convert.py

      - uses: actions/upload-artifact@v4

        with:

          name: converted-queries

          path: dist/