security.yml

name: Security Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: sentinelai-security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security-audit:
    name: Dependency & Secret Shield
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Scan for exposed secrets
        uses: trufflesecurity/trufflehog@v3.95.2
        with:
          extra_args: --only-verified

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: requirements.txt

      - name: Install dependency audit tooling
        run: |
          python -m pip install --upgrade pip
          python -m pip install pip-audit

      - name: Audit runtime dependencies
        run: pip-audit -r requirements.txt