fix(para): stop suggest_archive dividing by a non-positive inactive_days #2760
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # Weekly on Monday at 06:00 UTC | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit-dependencies: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Upgrade pip | |
| run: python -m pip install --upgrade pip | |
| - name: Install pip-audit | |
| run: python -m pip install pip-audit pyyaml | |
| - name: Install project (for accurate dependency resolution) | |
| run: bash scripts/pip_install_retry.sh -e . | |
| - name: Run pip-audit | |
| run: pip-audit --format json -o .pip-audit.json || true | |
| - name: Gate pip-audit findings against accepted risks | |
| run: python scripts/security/pip_audit_gate.py --audit .pip-audit.json | |
| bandit-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install bandit | |
| run: python -m pip install bandit[toml] | |
| - name: Run bandit | |
| run: bandit -r src/ -c pyproject.toml || true | |
| codeql-analysis: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| with: | |
| languages: python | |
| config-file: ./.github/codeql/codeql-config.yml | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3 | |
| checkov-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install checkov | |
| run: python -m pip install checkov==3.3.8 | |
| - name: Run checkov scan | |
| run: checkov -d . --framework github_actions dockerfile secrets --compact --skip-path .git |