security_audit.yml

name: Security Audit

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install pip
        run: |
          python -m pip install --upgrade pip
      
      - name: Install build tools
        run: |
          python -m pip install --upgrade setuptools wheel
      
      - name: Install omnipkg with its dependencies
        run: |
          pip install ".[demo]"
      
      - name: Run pip-audit
        uses: pypa/gh-action-pip-audit@v1.1.0
        with:
          # Ignore GHSA-4xh5-x5gv-qwph - awaiting pip 25.3 release
          # Risk: Low - only exploitable via malicious sdists, we only install from PyPI
          ignore-vulns: |
            GHSA-4xh5-x5gv-qwph