security.yml

name: Security

on:
  push:
    branches: [main]
    paths:
      - '**/pyproject.toml'
      - '**/uv.lock'
      - '**/Cargo.toml'
      - '**/Cargo.lock'

  schedule:
    # Run weekly security scans
    - cron: '0 2 * * 1'
  workflow_dispatch:

jobs:
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    # issues: write — rustsec/audit-check creates issues for new advisories.
    # checks: write — rustsec/audit-check posts check annotations.
    permissions:
      issues: write
      checks: write
    steps:
      - uses: actions/checkout@v7

      - name: Run Rust security audit
        uses: rustsec/audit-check@v2.0.0
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Install uv
        uses: astral-sh/setup-uv@v10.1.0
        with:
          version: "latest"
      
      - name: Set up Python
        run: uv python install 3.12
      
      - name: Run Python security scan
        # pip-audit checks the locked dependency set against the PyPI advisory
        # database and needs no account. (`safety scan` requires an interactive
        # login since Safety 3, so it exited 1 on every run and the
        # continue-on-error that hid that made the step a no-op.)
        # `uv export` writes the fully pinned, hashed set from uv.lock, and
        # `--disable-pip` audits exactly those pins without resolving anything.
        run: |
          uv export --all-groups --no-emit-project --format requirements-txt --output-file requirements-audit.txt
          uvx pip-audit --disable-pip --requirement requirements-audit.txt
        continue-on-error: true  # Don't fail CI on security advisories, just report

  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: python
      
      - name: Autobuild
        uses: github/codeql-action/autobuild@v4
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4