Reconcile model/migration drift in buyback, identity, planetary, sde #16

	# Dependency-vulnerability scan (pip-audit).
	#
	# This is the CI path for the same scan that runs weekly in-stack via Celery beat
	# (admin_audit.audit_dependencies) — production deploys do NOT go through GitHub, so
	# the beat job is the authoritative recurring control; this workflow gates code that
	# is pushed to GitHub and gives a weekly second look.
	#
	# Hardening: every `uses:` is pinned to a full commit SHA. A tag is mutable and can
	# be repointed at malicious code by a compromised maintainer account.

	name: security

	on:
	push:
	branches: [main]
	paths: ["requirements.txt", "requirements-dev.txt", ".github/workflows/security.yml"]
	pull_request:
	paths: ["requirements.txt", "requirements-dev.txt"]
	schedule:
	- cron: "30 6 * * 1" # Mondays 06:30 UTC, matching the in-stack beat job
	workflow_dispatch: {}

	permissions:
	contents: read # least privilege: the job only needs to read the repo

	jobs:
	pip-audit:
	runs-on: ubuntu-latest
	steps:
	# persist-credentials: false — this job only reads the repo, so don't leave the
	# checkout token in .git/config where a later step could reuse it.
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.12"
	- name: Install pip-audit
	run: pip install "pip-audit>=2.7,<3.0"
	- name: Audit pinned dependencies
	run: pip-audit -r requirements.txt --progress-spinner off

Navigation Menu