From 4d36530acb999d8ff9e91548c6647a66384aa632 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nerijus=20Bend=C5=BEi=C5=ABnas?= Date: Sun, 14 Jun 2026 08:29:08 +0300 Subject: [PATCH] ci: audit dependencies for known vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Runs `uv audit` on every PR plus a weekly cron, since CVEs are disclosed against the static lockfile between dependency changes. Signed-off-by: Nerijus Bendžiūnas --- .github/workflows/security-audit.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/security-audit.yml diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml new file mode 100644 index 0000000..d71827c --- /dev/null +++ b/.github/workflows/security-audit.yml @@ -0,0 +1,22 @@ +--- +name: Security Audit +on: # yamllint disable-line rule:truthy + pull_request: + schedule: + - cron: 13 3 * * 2 +permissions: + contents: read +jobs: + audit: + runs-on: ubuntu-latest + steps: + - name: Checkout code + # yamllint disable-line rule:line-length + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Install uv + # yamllint disable-line rule:line-length + uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0 + - name: Audit dependencies + run: uv audit --frozen --preview-features audit-command