name: Dependency Audit

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    - cron: "0 8 1 * *"

permissions:
  contents: read
  security-events: write

jobs:
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"

      - name: Install uv
        uses: astral-sh/setup-uv@v4

      - name: Export requirements from uv
        run: uv export --no-hashes -o requirements-audit.txt

      - uses: pypa/gh-action-pip-audit@release/v1
        with:
          input: requirements-audit.txt

      - name: Cleanup
        if: always()
        run: rm -f requirements-audit.txt