Make the truth table a reusable analytical object (#17) #35

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	schedule:
	# Weekly, so newly disclosed advisories surface without a code change.
	- cron: "17 6 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	audit:
	name: Dependency audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v7

	- uses: actions/setup-python@v7
	with:
	python-version: "3.12"

	- name: Install Poetry
	run: pipx install poetry==2.2.1

	- name: Export the resolved runtime dependency set
	run: \|
	poetry self add poetry-plugin-export
	poetry export --without-hashes --format=requirements.txt --output=requirements.txt

	- name: Audit dependencies for known vulnerabilities
	run: \|
	python -m pip install --upgrade pip-audit
	pip-audit --requirement requirements.txt --strict

	codeql:
	name: CodeQL analysis
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	actions: read
	steps:
	- uses: actions/checkout@v7

	- uses: github/codeql-action/init@v3
	with:
	languages: python
	queries: security-and-quality

	- uses: github/codeql-action/analyze@v3
	with:
	category: "/language:python"

Navigation Menu