security.yaml

---
# This workflow will install Python dependencies
# run tests and lint with a variety of Python versions
# For more information see:
# https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: "⛔️ Security auditing (Matrix)"

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, edited, synchronize]
    branches:
      - "*"
      - "!update-devops-tooling"

jobs:
  build:
    name: "Audit Python dependencies"
    runs-on: ubuntu-latest
    # Don't run when pull request is merged
    if: github.event.pull_request.merged == false
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10", "3.11"]

    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Setup PDM for build commands"
        uses: pdm-project/setup-pdm@v3
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Install dependencies"
        run: |
          pip install --upgrade pip
          pdm lock
          pdm export -o requirements.txt
          python -m pip install -r requirements.txt
          python -m pip install .
          pdm list --graph

      - name: "Run: pip-audit"
        uses: pypa/gh-action-pip-audit@v1.0.8