security.yaml

---
# This workflow will install Python dependencies
# run tests and lint with a variety of Python versions
# For more information see:
# https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: "⛔️ Security auditing"

on:  # yamllint disable-line rule:truthy
  workflow_dispatch:
  pull_request:
    types:
      [opened, reopened, edited]

jobs:
  build:
    name: "Audit Python dependencies"
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ['3.9', '3.10', '3.11']
    steps:

      - name: "Checkout repository"
        uses: actions/checkout@v3

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Install dependencies"
        run: |
          pip install --upgrade pip
          pdm lock
          pdm export -o requirements.txt
          python -m pip install -r requirements.txt
          python -m pip install .

      - name: "Run: pip-audit"
        uses: pypa/gh-action-pip-audit@v1.0.8
        with:
          ignore-vulns: |
            PYSEC-2023-163