audit.yml

name: Dependency Audit

on:
  push:
    branches: [main]
    paths:
      - "requirements.txt"
      - "requirements.lock"
      - "pyproject.toml"
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 9 * * 1"   # every Monday at 09:00 UTC
  workflow_dispatch:

# Read-only — this workflow only audits + uploads a report artifact. Note it is
# also pull_request-triggered, so it MUST stay non-privileged (no secrets, no
# write perms, no consumption of its artifact by a privileged workflow).
permissions:
  contents: read

jobs:
  audit:
    name: pip-audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
        with:
          python-version: "3.11"

      - name: Install pip-audit
        run: pip install pip-audit

      - name: Audit core dependencies (hash-verified lockfile)
        # --require-hashes ensures we audit what we actually ship,
        # not a drift from the lockfile.
        run: |
          pip-audit \
            --requirement requirements.lock \
            --require-hashes \
            --strict \
            --format markdown \
            --output audit-report.md
        continue-on-error: false

      - name: Audit optional extras
        # Audits the broader dependency tree declared in pyproject.toml
        # without requiring hashes (extras are not in the lockfile).
        run: |
          pip-audit \
            --requirement requirements.txt \
            --strict \
            --format markdown >> audit-report.md
        continue-on-error: false

      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: audit-report
          path: audit-report.md