security.yml

name: security

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: "17 4 * * 1"

permissions:
  contents: read

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install bandit
        run: pip install "bandit[toml]"
      - name: Static analysis (bandit, medium+ severity blocks)
        run: bandit -r src -ll
      - name: Dependency audit (pip-audit)
        run: |
          python -m pip install --upgrade pip
          pip install -e .
          pip install pip-audit
          pip-audit --skip-editable

  secret-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}