 Pascal THUETandGitHub
|
ebd3097eb3
|
ci: add dependency audit workflow (#3138)
* ci: add dependency audit workflow
Add a Security Audit workflow with a dependency-audit job. Push/PR/manual
runs pip-audit against a committed --generate-hashes requirements snapshot
(.github/security-audit-requirements.txt) for deterministic CI, while the
weekly scheduled run resolves the runtime + test dependency set live across
the supported Python/OS matrix to surface newly published advisories.
A sync gate (.github/scripts/check_security_requirements.py) fails PRs whose
dependency inputs changed without refreshing the committed snapshot, so the
committed file can't silently drift from pyproject.toml.
Assisted-by: Codex (model: GPT-5, autonomous)
* ci: split dependency audit schedule matrix
Assisted-by: Codex (model: GPT-5, autonomous)
* ci: harden dependency audit sync checks
Assisted-by: Codex (model: GPT-5, autonomous)
* ci: align security workflow python pin
Assisted-by: Codex (model: GPT-5, autonomous)
* ci: refresh dependency audit baseline
Assisted-by: Codex (model: GPT-5, autonomous)
* docs: clarify security snapshot audit
Assisted-by: Codex (model: GPT-5, autonomous)
|
2026-07-22 05:20:55 -05:00 |
|