update-requirements.yml

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:

jobs:
  security:
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      
      - name: Install pip-audit
        run: pip install pip-audit
      
      - name: Run pip-audit
        id: pip-audit
        continue-on-error: true
        run: |
          echo "## pip-audit Security Scan" >> $GITHUB_STEP_SUMMARY
          pip-audit --desc --format markdown >> $GITHUB_STEP_SUMMARY || true
          pip-audit --require pyproject.toml
      
      - name: Try Safety fallback
        if: steps.pip-audit.outcome == 'failure'
        continue-on-error: true
        env:
          SAFETY_API_KEY: ${{ secrets.SAFETY_API_KEY }}
        run: |
          if [ -n "$SAFETY_API_KEY" ]; then
            pip install safety
            echo "## Safety Scan" >> $GITHUB_STEP_SUMMARY
            safety check --output json || echo "Safety API down"
          fi
      
      - name: Summary
        if: always()
        run: echo "✅ Security scan completed"