name: Security Audit

on:
  schedule:
    # Monthly on the 1st at 06:00 UTC (low frequency)
    - cron: "0 6 1 * *"
  workflow_dispatch: {}

permissions:
  contents: read

jobs:
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install uv
        uses: astral-sh/setup-uv@v7

      - name: Resolve and export dependencies
        run: |
          uv lock
          uv export --frozen --no-hashes --no-emit-project --format requirements-txt > requirements.txt

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Audit dependencies (OSV / PyPI Advisory DB)
        run: |
          python -m pip install --quiet pip-audit
          pip-audit -r requirements.txt --no-deps --desc