fix(ci): switch release trigger to push on main for PyPI environment compatibility #41

	# PR-focused security checks.
	# Purpose: catch dependency vulnerabilities and leaked secrets before merge.
	name: Security

	on:
	# Security checks are required for all PRs into main.
	pull_request:
	branches: [main]

	permissions:
	# Required by checkout and PR-context scanners.
	contents: read
	pull-requests: read

	env:
	# Keep scanner runtime consistent across runs.
	PYTHON_VERSION: "3.11"

	jobs:
	security:
	# Single job that combines package audit and secret scanning.
	name: Dependency and Secret Scan
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Install Poetry
	run: pipx install poetry

	- name: Setup Python
	uses: actions/setup-python@v6
	with:
	python-version: ${{ env.PYTHON_VERSION }}
	cache: poetry
	cache-dependency-path: poetry.lock

	- name: Install pip-audit
	run: pipx install pip-audit

	- name: Install dependencies
	run: poetry install --no-interaction --no-ansi

	- name: Python dependency audit
	# Audit the exact dependency graph exported from Poetry.
	run: pip-audit --requirement <(poetry export --without-hashes -f requirements.txt)

	- name: Secret scan
	# Scan only PR diff range to reduce noise and speed up checks.
	uses: trufflesecurity/trufflehog@v3.94.3
	with:
	path: ./
	base: ${{ github.event.pull_request.base.sha }}
	head: ${{ github.event.pull_request.head.sha }}

Navigation Menu