security.yml

name: Security

on:
  schedule:
    # Run security checks weekly
    - cron: '0 2 * * 1'
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

jobs:
  security:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: "3.13"
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install -r requirements-dev.txt
        pip install safety bandit
    
    - name: Run safety check
      run: |
        safety check --json --output safety-report.json || true
        safety check --full-report
    
    - name: Run bandit security scan
      run: |
        bandit -r cost_katana/ -f json -o bandit-report.json || true
        bandit -r cost_katana/ -f txt
    
    - name: Upload safety results to GitHub
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: safety-report
        path: safety-report.json
    
    - name: Upload bandit results to GitHub
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: bandit-report
        path: bandit-report.json