security.yml

name: Security Scan

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: "0 6 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  python-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v7

      - name: Install dependencies
        run: uv sync --extra dev --extra dashboard --extra server

      - name: Install pip-audit and bandit
        run: uv pip install pip-audit bandit

      - name: Run pip-audit
        run: >-
          uv run pip-audit --local
          --ignore-vuln GHSA-46jp-xpjr-93v5
          --ignore-vuln GHSA-fpc7-926f-7q6q
          --ignore-vuln GHSA-8m8c-m7c6-2mx4

      - name: Run bandit
        run: uv run bandit -r verdict -ll -s B108

  node-security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Set up Node
        uses: actions/setup-node@v7
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: package-lock.json

      - name: Install workspace dependencies
        run: npm ci --ignore-scripts

      - name: Audit runtime dependencies
        run: npm audit --omit=dev --audit-level=high

  osv-security:
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8
    with:
      scan-args: |-
        --config=./osv-scanner.toml
        --lockfile=./uv.lock
        --lockfile=./package-lock.json
    permissions:
      actions: read
      contents: read
      security-events: write