Security #47

	name: Security

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main]
	schedule:
	- cron: "30 3 * * 1"

	permissions:
	contents: read
	security-events: write

	jobs:
	codeql:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: github/codeql-action/init@v3
	with:
	languages: python
	- uses: github/codeql-action/analyze@v3

	python-deps:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v4
	with:
	python-version: "3.11"
	- name: Install and audit Python dependencies
	run: \|
	python -m pip install --upgrade pip pip-audit
	pip install -r requirements.txt
	pip-audit -r requirements.txt

	rust-deps:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: dtolnay/rust-toolchain@stable
	- name: Install cargo-audit
	run: cargo install cargo-audit --locked
	- name: Audit Rust dependencies
	run: \|
	cd extracted/rust
	cargo audit

	secret-scan:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Run TruffleHog
	uses: trufflesecurity/trufflehog@v3.81.0
	with:
	path: ./
	extra_args: --only-verified

Navigation Menu