name: Security

on:
  schedule:
    - cron: '0 0 * * 1'
  workflow_dispatch:
  pull_request:
    branches: [main]
    paths:
      - 'pyproject.toml'
      - '.github/workflows/security.yml'

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
        with:
          python-version: '3.11'
      # Upgrade first: actions/setup-python's baked-in setuptools has been
      # behind known-vulnerable floors before (e.g. PYSEC-2026-3447 /
      # CVE-2026-59890, fixed in 83.0.0) regardless of what this project's
      # own [build-system] requires -- that only governs isolated build
      # environments, not the ambient one pip-audit scans here.
      - run: python -m pip install --upgrade pip setuptools
      - run: pip install pip-audit
      # Install the [all] extra so pip-audit sees every optional dependency
      # group (fastapi, python-multipart, etc.), not just pip-audit's own
      # deps. PYSEC-2024-38 (#869) shipped in the first place because
      # neither this job (bare env, no extras) nor security-scan.yml's
      # Safety check (installs only [llm-litellm]) ever had fastapi or
      # python-multipart installed to look at.
      - run: pip install -e ".[all]"
      # PR runs gate on findings, since they're scoped to actual
      # pyproject.toml changes under review. The schedule/workflow_dispatch
      # runs stay non-blocking until a full pass over pre-existing findings
      # across the whole [all] tree has been done.
      - run: pip-audit
        continue-on-error: ${{ github.event_name != 'pull_request' }}