security.yml

name: Security Audit

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  dependency-audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Install uv
        uses: astral-sh/setup-uv@v8.1.0

      - name: Export locked dependencies
        run: |
          uv export \
            --locked \
            --format requirements-txt \
            --all-groups \
            --all-extras \
            --no-emit-project \
            --no-hashes \
            --output-file requirements-audit.txt \
            >/dev/null

      - name: Audit dependencies
        run: |
          uvx pip-audit \
            --requirement requirements-audit.txt \
            --no-deps \
            --disable-pip \
            --progress-spinner off