From 50118b88d9c29b45a9d05cc93cdcf3a8a2a8f3cd Mon Sep 17 00:00:00 2001 From: Javier Lopez Lorente Date: Mon, 26 Oct 2026 15:58:37 +0100 Subject: [PATCH] Add automated Python dependency security audit --- .github/workflows/pip-audit.yml | 37 +++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/pip-audit.yml diff --git a/.github/workflows/pip-audit.yml b/.github/workflows/pip-audit.yml new file mode 100644 index 0000000..add7fc0 --- /dev/null +++ b/.github/workflows/pip-audit.yml @@ -0,0 +1,37 @@ +name: Python dependency security audit + +on: + schedule: + # Run every Monday at 06:00 UTC + - cron: "0 6 * * 1" + + pull_request: + + # Allow this workflow to be run manually. + workflow_dispatch: + +jobs: + pip-audit: + name: Audit Python dependencies + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: "3.12" + + - name: Upgrade pip + run: python -m pip install --upgrade pip + + - name: Install SolarFarmer Python SDK + run: python -m pip install . + + - name: Check installed dependencies + run: python -m pip check + + - name: Run pip-audit + uses: pypa/gh-action-pip-audit@v1.1.0 \ No newline at end of file