Harden scanners, improve CLI behavior, and enhance testing coverage

.github/workflows/ci.yml

@@ -2,27 +2,40 @@ name: CI
 
 on:
   push:
-    branches: [main, "feat/**"]
+    branches: [main, "feat/**", "fix/**"]
   pull_request:
     branches: [main]
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    name: Tests (${{ matrix.os }}, Python ${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.10", "3.11", "3.12"]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
-
-      - name: Install async scanner dependency
-        run: python -m pip install --upgrade pip aiohttp
-
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - name: Upgrade pip
+        run: python -m pip install --upgrade pip
+      - name: Install dependencies and security tools
+        run: python -m pip install -r requirements.txt pytest bandit pip-audit
       - name: Compile Python sources
-        run: python -m compileall -q .
-
-      - name: Run tests
+        run: python -m compileall -q SpectraScan.py modules tests
+      - name: Startup/import smoke test
+        run: python -c "import SpectraScan; from modules.async_scanner import AsyncPortScanner; from modules.vuln_scanner import VulnScanner"
+      - name: Run regression tests
         run: python -m unittest discover -s tests -p "test_*.py"
+      - name: Static security checks for hardened modules
+        if: runner.os == 'Linux'
+        run: bandit -r modules/async_scanner.py modules/brute_forcer.py modules/vuln_scanner.py modules/report_store.py -ll
+      - name: Dependency vulnerability audit
+        if: runner.os == 'Linux' && matrix.python-version == '3.12'
+        run: pip-audit -r requirements.txt