security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
    types: [opened, synchronize, reopened, ready_for_review]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  osv-scan:
    name: Dependency Scan
    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
    timeout-minutes: 5
    steps:
      - uses: useblacksmith/checkout@v1

      - name: Install osv-scanner
        run: |
          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
          chmod +x osv-scanner

      - name: Scan dependencies
        run: ./osv-scanner scan source --lockfile=uv.lock --format=table

  pip-audit:
    name: Python Audit
    runs-on: blacksmith-2vcpu-ubuntu-2404-arm
    timeout-minutes: 5
    steps:
      - uses: useblacksmith/checkout@v1
      - uses: astral-sh/setup-uv@v10.2.0
        with:
          version: "0.12.17"
      - uses: actions/setup-python@v7
        with:
          python-version: "3.13"

      - name: Install pip-audit
        run: pip install pip-audit

      - name: Audit dependencies
        run: |
          uv export --format requirements-txt --no-hashes > requirements.txt
          pip-audit -r requirements.txt --disable-pip --no-deps