security-scan.yml

# Security and dependency scans on every PR + weekly schedule.
# Runs:
#   - bandit (Python security linter, looks for unsafe patterns in code)
#   - pip-audit (checks installed packages against known CVEs)
#   - ruff (lint quality gate; runtime-blocking style issues)
#
# This workflow is non-blocking for PRs by default. To gate merges on it,
# add it as a required status check in branch protection rules.

name: Security Scan

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Re-run every Monday at 09:00 UTC to catch new CVEs in unchanged code
    - cron: "0 9 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"
          cache: "pip"

      - name: Install project + security tools
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[dev]"
          pip install bandit pip-audit

      - name: bandit (Python security linter)
        run: |
          bandit -r src/ -ll -f txt

      - name: pip-audit (dependency CVE check)
        # We allow this step to fail-soft: dev-tool transitive CVEs are noted
        # but don't break the build. Real runtime-dep CVEs are inspected manually.
        continue-on-error: true
        run: |
          pip-audit --strict --vulnerability-service=osv

      - name: ruff (lint quality gate)
        run: |
          ruff check src/ tests/

      - name: pytest (test suite)
        run: |
          pytest -q