feat(cli)!: replace commands monolith with module-per-command architecture #63

	# PR-focused security checks.
	# Purpose: catch dependency vulnerabilities and leaked secrets before merge.
	name: Security

	on:
	# Security checks are required for all PRs into main.
	pull_request:
	branches: [main]

	concurrency:
	# Cancel superseded security scans for the same PR.
	group: security-${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	# Required by checkout and PR-context scanners.
	contents: read
	pull-requests: read

	env:
	# Keep scanner runtime consistent across runs.
	PYTHON_VERSION: "3.11"
	# Pin Poetry CLI version for deterministic CI behavior.
	POETRY_VERSION: "2.3.4"

	jobs:
	security:
	# Single job that combines package audit and secret scanning.
	name: Dependency and Secret Scan
	runs-on: ubuntu-latest

	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Install Poetry
	run: pipx install "poetry==${POETRY_VERSION}"

	- name: Setup Python
	uses: actions/setup-python@v6
	with:
	python-version: ${{ env.PYTHON_VERSION }}
	cache: poetry
	cache-dependency-path: poetry.lock

	- name: Install pip-audit
	run: pipx install pip-audit

	- name: Install dependencies
	run: poetry install --no-interaction --no-ansi

	- name: Python dependency audit
	# Audit the exact dependency graph exported from Poetry.
	run: pip-audit --requirement <(poetry export --without-hashes -f requirements.txt)

	- name: Secret scan
	# Scan only PR diff range to reduce noise and speed up checks.
	uses: trufflesecurity/trufflehog@v3.94.3
	with:
	path: ./
	base: ${{ github.event.pull_request.base.sha }}
	head: ${{ github.event.pull_request.head.sha }}

Navigation Menu