security.yml

name: security

# Three gates, none of which may be silenced. A project whose whole argument is that absence of
# disclosure should be visible cannot run its own security checks with `|| true`.
#
# - gitleaks scans history for committed secrets. The only secret this repo legitimately holds
#   is DATA_GOV_API_KEY, and it lives in Actions secrets, never in git.
# - semgrep is the SAST pass over the source. It complements the ruff `S` (bandit) rules that
#   already run in `make verify`; semgrep sees taint-shaped problems ruff does not.
# - pip-audit checks every locked dependency for known vulnerabilities. The project has zero
#   runtime dependencies by design, so the exported set is the dev toolchain, which is the only
#   dependency surface that exists.

on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: "17 10 * * 3" # weekly; catches advisories published after the last code change

permissions:
  contents: read

jobs:
  secret-scan:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0 # gitleaks scans history, not just the tip
          persist-credentials: false
      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sast:
    name: SAST (semgrep)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Semgrep scan
        env:
          SEMGREP_SEND_METRICS: "off"
        run: |
          python -m pip install "semgrep==1.169.0"
          semgrep scan --config p/default --config p/python --config p/security-audit \
            --error --severity=ERROR src tests

  dependency-audit:
    name: Dependency audit (pip-audit over uv.lock)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: pip-audit the locked set
        run: |
          python -m pip install "pip-audit==2.10.1" "uv==0.12.1"
          uv export --frozen --no-emit-project --output-file /tmp/disclosed-locked.txt
          pip-audit --strict --requirement /tmp/disclosed-locked.txt