chore(deps): Update GitHub Actions #415
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # Security Analysis Workflow | |
| # Runs security scans including Bandit, Safety, and dependency checks. | |
| # | |
| # Features: | |
| # - Bandit static analysis for Python | |
| # - Safety dependency vulnerability scanning | |
| # - Weekly scheduled scans | |
| name: Security Analysis | |
| "on": | |
| merge_group: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| schedule: | |
| # Run security scans weekly on Monday at 9 AM UTC | |
| - cron: '0 9 * * 1' | |
| workflow_dispatch: | |
| # Note: Concurrency is handled by the org-level reusable workflow | |
| # Do NOT define concurrency here to avoid deadlock with called workflow | |
| # Note: CodeQL and other security tools need actions:read and security-events:write | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| pull-requests: write | |
| # Uses org-level reusable workflow | |
| jobs: | |
| security: | |
| name: Security Analysis | |
| uses: ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@7d12f5486ab5c856397ebaa4acd3c99ca385227c # main | |
| with: | |
| source-directory: 'src' | |
| python-version: '3.12' | |
| fail-on-high: true | |
| fail-on-medium: false | |
| # CodeQL is disabled here because the repository uses GitHub's default CodeQL setup. | |
| # Running both default and advanced configurations causes SARIF upload conflicts. | |
| # See: https://docs.github.com/en/code-security/code-scanning/enabling-code-scanning | |
| run-codeql: false | |
| run-dependency-review: true | |
| run-bandit: true | |
| # run-safety removed: the org reusable dropped this input in | |
| # ByronWilliamsCPA/.github#140 (chore(security)!: remove redundant | |
| # safety scanner) on 2026-05-18, causing startup_failure on every | |
| # PR until the caller stopped passing it. pip-audit and bandit | |
| # cover the surface previously scanned by safety. | |
| # OSV Scanner disabled due to bug in v2.2.4 where filtered vulnerabilities are | |
| # incorrectly reported as "unused ignores" causing exit code 1. | |
| # See: https://github.com/google/osv-scanner/issues - needs bug report | |
| # Re-enable after org workflow updates to fixed version. | |
| run-osv: false | |
| # rag-processor uses hatchling as build backend, so editable installs | |
| # require the build step. The reusable defaults no-build: true; override. | |
| no-build: false |