Multioutput proposal #114

	name: "Security Analysis"

	on:
	push:
	branches: [ "main" ]
	pull_request:
	branches: [ "main" ]
	schedule:
	- cron: '30 4 * * 1' # Weekly on Mondays at 4:30 AM UTC

	permissions:
	contents: read
	security-events: write
	actions: read

	jobs:
	dependency-scan:
	name: Dependency Vulnerability Scan
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v5

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: '3.11'

	- name: Install uv
	uses: astral-sh/setup-uv@v7
	with:
	version: "latest"

	- name: Install dependencies
	run: \|
	uv sync --extra dev

	- name: Run safety check
	run: \|
	uv add safety
	uv run safety check --json --output safety-report.json \|\| true

	- name: Run bandit security linter
	run: \|
	uv add bandit[toml]
	uv run bandit -r gpjax/ -f json -o bandit-report.json \|\| true

	- name: Upload dependency scan results
	uses: actions/upload-artifact@v5
	if: always()
	with:
	name: security-scan-results
	path: \|
	safety-report.json
	bandit-report.json
	retention-days: 30

	secrets-scan:
	name: Secrets Detection
	runs-on: ubuntu-latest

	steps:
	- name: Checkout repository
	uses: actions/checkout@v5
	with:
	fetch-depth: 0 # Fetch full history for comprehensive scanning

	- name: Run TruffleHog OSS
	uses: trufflesecurity/trufflehog@main
	with:
	path: ./
	extra_args: --debug --only-verified

Provide feedback