security.yaml

---
# This workflow will install Python dependencies
# run tests and lint with a variety of Python versions
# For more information see:
# https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: "⛔️ Security auditing"

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, edited, synchronize]

jobs:
  build:
    name: "Audit Python dependencies"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.9", "3.10"]
    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v4

      - name: "Setup PDM for build commands"
        uses: pdm-project/setup-pdm@v3
        with:
          version: 2.10.3

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Install dependencies"
        run: |
          pip install --upgrade pip
          pdm lock
          pdm export -o requirements.txt
          python -m pip install -r requirements.txt
          python -m pip install .
          pdm list --graph > module-graph.txt 2>&1

      - name: Store the dependency graph
        uses: actions/upload-artifact@v3
        with:
          name: module-graph.txt
          path: module-graph.txt
          retention-days: 30

      - name: "Run: pip-audit"
        uses: pypa/gh-action-pip-audit@v1.0.8