chore: pipeline improvements

Author: TomKaltofen

.github/workflows/security-scan.yaml

@@ -0,0 +1,45 @@
+name: Weekly Security Scan
+
+on:
+  schedule:
+    # Run every Monday at 9:00 AM UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch:  # Allow manual triggering from any branch
+
+permissions:
+  contents: read
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Python 3.10
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.10"
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install tox
+
+    - name: Get package name and latest release version
+      id: get_info
+      run: |
+        PACKAGE_NAME=$(grep -E '^name = ' pyproject.toml | head -1 | sed 's/name = "\(.*\)"/\1/')
+        echo "package_name=$PACKAGE_NAME" >> $GITHUB_OUTPUT
+        echo "Package name: $PACKAGE_NAME"
+
+        LATEST_VERSION=$(curl -s https://api.github.com/repos/${{ github.repository }}/releases/latest | jq -r '.tag_name' | sed 's/^v//')
+        echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
+        echo "Latest version: $LATEST_VERSION"
+
+    - name: Run security scan with tox
+      env:
+        PACKAGE_NAME: ${{ steps.get_info.outputs.package_name }}
+        PACKAGE_VERSION: ${{ steps.get_info.outputs.version }}
+      run: tox -e security
+      timeout-minutes: 10

.releaserc.yaml

@@ -8,7 +8,11 @@ plugins:
     - preset: conventionalcommits
       releaseRules:
         - type: feat
+          release: patch
+        - type: minor
           release: minor
+        - type: impr
+          release: patch
         - type: fix
           release: patch
         - type: perf
@@ -35,6 +39,12 @@ plugins:
           - type: feat
             section: "Features"
             hidden: false
+          - type: minor
+            section: "Minor Changes"
+            hidden: false
+          - type: impr
+            section: "Improvements"
+            hidden: false
           - type: fix
             section: "Bug Fixes"
             hidden: false

tox.ini

@@ -11,3 +11,27 @@ commands =
     ruff check .
     mypy --strict --ignore-missing-imports .
     bandit -c pyproject.toml -r -q .
+
+[testenv:security]
+# CVE scanning environment - downloads specific version of published package
+skip_install = False
+usedevelop = False
+deps =
+    pip-audit
+allowlist_externals = sh, rm, mkdir
+commands =
+    mkdir -p security-reports
+
+    sh -c "pip uninstall -y {env:PACKAGE_NAME} || true"
+
+    sh -c "pip install {env:PACKAGE_NAME}=={env:PACKAGE_VERSION}"
+
+    sh -c "pip list"
+
+    # Run CVE scan
+    sh -c "pip-audit --desc --format=json --output=security-reports/pip-audit-version.json || pip-audit --desc"
+
+    # Display summary
+    sh -c "echo '=== CVE Scan Summary ==='"
+    sh -c "echo 'Tool: pip-audit (Apache 2.0 licensed)'"
+    sh -c "echo 'Report: security-reports/pip-audit-version.json'"