deps: update celery requirement from <5.6,>=5.5 to >=5.6.3,<5.7 #5

	# Dependency-vulnerability scan (pip-audit).
	#
	# This is the CI path for the same scan that runs weekly in-stack via Celery beat
	# (admin_audit.audit_dependencies) — production deploys do NOT go through GitHub, so
	# the beat job is the authoritative recurring control; this workflow gates code that
	# is pushed to GitHub and gives a weekly second look.
	#
	# Hardening: every `uses:` is pinned to a full commit SHA. A tag is mutable and can
	# be repointed at malicious code by a compromised maintainer account.

	name: security

	on:
	push:
	branches: [main]
	paths: ["requirements.txt", "requirements-dev.txt", ".github/workflows/security.yml"]
	pull_request:
	paths: ["requirements.txt", "requirements-dev.txt"]
	schedule:
	- cron: "30 6 * * 1" # Mondays 06:30 UTC, matching the in-stack beat job
	workflow_dispatch: {}

	permissions:
	contents: read # least privilege: the job only needs to read the repo

	jobs:
	pip-audit:
	runs-on: ubuntu-latest
	steps:
	# persist-credentials: false — this job only reads the repo, so don't leave the
	# checkout token in .git/config where a later step could reuse it.
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	persist-credentials: false
	- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: "3.12"
	- name: Install pip-audit
	run: pip install "pip-audit>=2.7,<3.0"
	- name: Audit pinned dependencies
	run: pip-audit -r requirements.txt --progress-spinner off

Navigation Menu