security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly: every Monday at 06:00 UTC.
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pip-audit:
    name: pip-audit (dependencies)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: pyproject.toml

      - name: Install package and pip-audit
        run: |
          pip install --require-hashes -r requirements-ci.txt
          pip install -e . --no-deps

      - name: Run pip-audit
        # --skip-editable skips the locally-installed editable attestix itself.
        # No --strict: under --strict pip-audit fails on any un-auditable dep,
        # and an editable self-install can never be audited (it errors even with
        # --skip-editable). Without --strict, pip-audit still exits non-zero on
        # any real dependency vulnerability — which is the behaviour we enforce.
        run: pip-audit --progress-spinner off --skip-editable

  bandit:
    name: bandit (source code SAST)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Set up Python
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: pyproject.toml

      - name: Install bandit
        run: pip install --require-hashes -r requirements-ci.txt

      - name: Run bandit (medium+ severity, medium+ confidence)
        run: bandit -r attestix -c pyproject.toml -ll -ii