docs(changelog): 3.2.0 #101
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # PR-focused security checks. | |
| # Purpose: catch dependency vulnerabilities and leaked secrets before merge. | |
| name: Security | |
| on: | |
| # Security checks are required for all PRs into main. | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| # Cancel superseded security scans for the same PR. | |
| group: security-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| # Required by checkout and PR-context scanners. | |
| contents: read | |
| pull-requests: read | |
| env: | |
| # Keep scanner runtime consistent across runs. | |
| PYTHON_VERSION: "3.11" | |
| # Pin Poetry CLI version for deterministic CI behavior. | |
| POETRY_VERSION: "2.4.1" | |
| # Keep Poetry virtual environments inside the workspace for deterministic paths. | |
| POETRY_VIRTUALENVS_IN_PROJECT: "true" | |
| # Pin pip-audit to avoid non-deterministic CI failures from tool updates. | |
| PIP_AUDIT_VERSION: "2.10.0" | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| security: | |
| # Single job that combines package audit and secret scanning. | |
| name: Dependency and Secret Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| - name: Install Poetry | |
| run: pipx install "poetry==${POETRY_VERSION}" | |
| - name: Setup Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: poetry | |
| cache-dependency-path: poetry.lock | |
| - name: Install pip-audit | |
| run: pipx install "pip-audit==${PIP_AUDIT_VERSION}" | |
| - name: Install dependencies | |
| run: poetry install --no-interaction --no-ansi | |
| - name: Python dependency audit | |
| # Audit the exact dependency graph exported from Poetry. | |
| run: pip-audit --requirement <(poetry export --without-hashes -f requirements.txt) | |
| - name: Secret scan | |
| # Scan only PR diff range to reduce noise and speed up checks. | |
| uses: trufflesecurity/trufflehog@17456f8c7d042d8c82c9a8ca9e937231f9f42e26 | |
| with: | |
| path: ./ | |
| base: ${{ github.event.pull_request.base.sha }} | |
| head: ${{ github.event.pull_request.head.sha }} |