security.yml

name: Security scan

on:
  push:
    branches: ["development", "staging", "main"]
  pull_request:
  schedule:
    # Catches newly disclosed CVEs in dependencies that haven't otherwise
    # changed — CodeQL/pip-audit only re-run on push/PR wouldn't see those.
    - cron: "0 6 * * 1"
  workflow_dispatch:

jobs:
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7

      - uses: github/codeql-action/init@v4
        with:
          languages: python

      - uses: github/codeql-action/analyze@v4

  dependency-audit:
    name: Dependency audit (pip-audit)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install package with dev dependencies
        run: pip install -e ".[dev]"

      - name: Run pip-audit
        run: |
          pip install pip-audit
          pip-audit