Dependency Security Check #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Security Check | |
| on: | |
| schedule: | |
| # Run weekly on Sunday at 3 AM UTC | |
| - cron: '0 3 * * 0' | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - 'requirements.txt' | |
| - '.github/workflows/dependency-check.yml' | |
| jobs: | |
| security-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: 🔄 Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: 🐍 Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.13' | |
| - name: 📦 Install pip-audit | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install pip-audit | |
| - name: 🔍 Run security audit | |
| run: | | |
| echo "🔐 Checking for known security vulnerabilities..." | |
| pip-audit --requirement requirements.txt --format=json --output=audit-results.json | |
| - name: 📊 Check for outdated packages | |
| run: | | |
| echo "📊 Checking for outdated packages..." | |
| pip install -r requirements.txt | |
| pip list --outdated --format=json > outdated-packages.json | |
| # Display results | |
| echo "## 🔐 Security Audit Results" >> $GITHUB_STEP_SUMMARY | |
| if [ -s audit-results.json ]; then | |
| echo "⚠️ Security vulnerabilities found - check audit-results.json" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "✅ No security vulnerabilities found" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## 📊 Outdated Packages" >> $GITHUB_STEP_SUMMARY | |
| if [ "$(cat outdated-packages.json)" != "[]" ]; then | |
| echo "📋 The following packages have updates available:" >> $GITHUB_STEP_SUMMARY | |
| echo '```json' >> $GITHUB_STEP_SUMMARY | |
| cat outdated-packages.json >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "✅ All packages are up to date" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: 📁 Upload audit results | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dependency-audit-${{ github.run_number }} | |
| path: | | |
| audit-results.json | |
| outdated-packages.json | |
| retention-days: 30 |