chore: add temporary push trigger for testing #1

	name: Vulnerability Audit

	on:
	schedule:
	# Run weekly on Mondays at 9:00 UTC
	- cron: "0 9 * * 1"
	workflow_dispatch:
	# Also run on PRs that change dependencies
	pull_request:
	paths:
	- "uv.lock"
	- "pyproject.toml"
	# Temporary: trigger on push to test the workflow
	push:
	branches:
	- feature/vulnerability-audit-poc

	jobs:
	# Approach 1: pip-audit (PyPA official tool)
	# Audits the installed environment after uv sync.
	# Pros: official PyPA tool, well-maintained, GitHub Action available
	# Cons: requires installing deps first (slower), doesn't read uv.lock directly
	pip-audit:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- name: Install uv and Python
	uses: astral-sh/setup-uv@v7
	with:
	enable-cache: true
	cache-dependency-glob: uv.lock
	- name: Install the project
	run: uv sync --locked --dev --all-extras
	- name: Run pip-audit
	run: uv run --with pip-audit pip-audit --strict --vulnerability-service osv --desc

	# Approach 2: uv-secure (reads uv.lock directly)
	# Pros: fast (no install needed), reads uv.lock natively, supports severity filtering
	# Cons: newer/less established tool
	uv-secure:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6
	- name: Install uv
	uses: astral-sh/setup-uv@v7
	- name: Run uv-secure
	run: uvx uv-secure uv.lock

Navigation Menu