name: Security

on:
  schedule:
    - cron: '0 0 * * 1'
  workflow_dispatch:
  pull_request:
    branches: [main]
    paths:
      - 'pyproject.toml'
      - 'requirements-ci.txt'
      - '.github/workflows/security.yml'

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: '3.11'
      # Upgrade first: actions/setup-python's baked-in setuptools has been
      # behind known-vulnerable floors before (e.g. PYSEC-2026-3447 /
      # setuptools 75.1.0), so don't trust the preinstalled one.
      - run: pip install -r .github/requirements/bootstrap.txt --require-hashes
      # Audit the pinned dependency set (requirements-ci.txt is compiled from
      # pyproject.toml with --extra all — the same coverage as the [all]
      # extra, minus the Linux-only gpu set — so this keeps scan parity with
      # CI/release builds without a time-dependent resolution). This is the
      # fix for PYSEC-2024-38 (#869): the bare-env job never had fastapi or
      # python-multipart installed to look at.
      - run: pip install -r requirements-ci.txt --require-hashes
      # PR runs gate on findings, since they're scoped to actual
      # pyproject.toml changes under review. The schedule/workflow_dispatch
      # runs stay non-blocking until a full pass over pre-existing findings
      # across the whole [all] tree has been done.
      - run: pip install -r .github/requirements/pip-audit.txt --require-hashes
      - run: pip-audit -r requirements-ci.txt
        continue-on-error: ${{ github.event_name != 'pull_request' }}