mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-10 04:00:35 +00:00
43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
name: Security
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 1'
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'pyproject.toml'
|
|
- 'requirements-ci.txt'
|
|
- '.github/workflows/security.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: '3.11'
|
|
# Upgrade first: actions/setup-python's baked-in setuptools has been
|
|
# behind known-vulnerable floors before (e.g. PYSEC-2026-3447 /
|
|
# setuptools 75.1.0), so don't trust the preinstalled one.
|
|
- run: python -m pip install --upgrade pip setuptools
|
|
# Audit the pinned dependency set (requirements-ci.txt is compiled from
|
|
# pyproject.toml with --extra all — the same coverage as the [all]
|
|
# extra, minus the Linux-only gpu set — so this keeps scan parity with
|
|
# CI/release builds without a time-dependent resolution). This is the
|
|
# fix for PYSEC-2024-38 (#869): the bare-env job never had fastapi or
|
|
# python-multipart installed to look at.
|
|
- run: pip install -r requirements-ci.txt
|
|
# PR runs gate on findings, since they're scoped to actual
|
|
# pyproject.toml changes under review. The schedule/workflow_dispatch
|
|
# runs stay non-blocking until a full pass over pre-existing findings
|
|
# across the whole [all] tree has been done.
|
|
- run: pip install pip-audit
|
|
- run: pip-audit -r requirements-ci.txt
|
|
continue-on-error: ${{ github.event_name != 'pull_request' }}
|