Visual Workflow Builder (Phases 1–8 + AI agent) → develop #610
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Python Dependency Audit | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| branches: [main, develop] | |
| push: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| if: false | |
| name: Audit image-service dependencies | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: apps/image-service | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect image-service changes | |
| id: changes | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| base_ref="origin/${{ github.base_ref }}" | |
| git fetch --no-tags --depth=1 origin "${{ github.base_ref }}" | |
| elif git rev-parse --verify HEAD~1 >/dev/null 2>&1; then | |
| base_ref="HEAD~1" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if git diff --quiet "$base_ref" HEAD -- apps/image-service/; then | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Skip when image-service is unchanged | |
| if: steps.changes.outputs.changed != 'true' | |
| run: echo "apps/image-service did not change; skipping dependency audit." | |
| - name: Set up Python | |
| if: steps.changes.outputs.changed == 'true' | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: '3.12' | |
| - name: Set up uv | |
| if: steps.changes.outputs.changed == 'true' | |
| uses: astral-sh/setup-uv@v7 | |
| - name: Sync locked dependencies | |
| if: steps.changes.outputs.changed == 'true' | |
| run: uv sync --locked | |
| - name: Export requirements | |
| if: steps.changes.outputs.changed == 'true' | |
| run: uv export --format requirements.txt --output-file requirements.txt | |
| - name: Audit Python dependencies | |
| if: steps.changes.outputs.changed == 'true' | |
| run: uvx pip-audit -r requirements.txt |