feat(auth): add login, register, refresh, logout API endpoints [REN-88] #45

	# RenderTrust Security Scanning
	# OWASP compliance: dependency audit + SAST
	name: Security

	on:
	pull_request:
	branches: [dev]
	push:
	branches: [dev]
	schedule:
	- cron: "0 6 * * 1" # Weekly Monday 6am UTC

	concurrency:
	group: security-${{ github.ref }}
	cancel-in-progress: true

	env:
	PYTHON_VERSION: "3.11"

	jobs:
	dependency-audit:
	name: Dependency Audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v5
	with:
	python-version: ${{ env.PYTHON_VERSION }}
	cache: pip

	- name: Install dependencies
	run: pip install ".[dev]"

	- name: Run pip-audit
	# CVE-2024-23342: ecdsa timing attack — no fix available, upstream considers OOS
	run: pip-audit --desc on --ignore-vuln CVE-2024-23342

	sast:
	name: Static Analysis (Semgrep)
	runs-on: ubuntu-latest
	container:
	image: semgrep/semgrep
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Run Semgrep
	run: semgrep scan --config auto --error core/auth/ core/api/ core/config.py core/database.py core/main.py
	env:
	SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

	secrets-scan:
	name: Secrets Detection
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Run Gitleaks
	uses: gitleaks/gitleaks-action@v2
	continue-on-error: true # Requires license for org repos
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Navigation Menu