ci: action pins, and drop the pyjwt allowlist that no longer fires #358

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	types: [opened, synchronize, reopened, ready_for_review]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	osv-scan:
	name: Dependency Scan
	runs-on: blacksmith-2vcpu-ubuntu-2404-arm
	timeout-minutes: 5
	steps:
	- uses: useblacksmith/checkout@v1

	- name: Install osv-scanner
	run: \|
	curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.4.0/osv-scanner_linux_arm64 -o osv-scanner
	chmod +x osv-scanner

	- name: Scan dependencies
	# `--config osv-scanner.toml` honors the in-repo allowlist (e.g. PYSEC-2025-183;
	# see the toml for justifications). Keep the pip-audit `--ignore-vuln` flags below
	# in sync with the same IDs.
	run: ./osv-scanner scan source --lockfile=uv.lock --config=osv-scanner.toml --format=table

	pip-audit:
	name: Python Audit
	runs-on: blacksmith-2vcpu-ubuntu-2404-arm
	timeout-minutes: 5
	steps:
	- uses: useblacksmith/checkout@v1
	- uses: astral-sh/setup-uv@v9.0.0
	- uses: actions/setup-python@v7
	with:
	python-version: "3.13"

	- name: Install pip-audit
	run: pip install pip-audit

	- name: Audit dependencies
	# Any `--ignore-vuln` flag here mirrors `osv-scanner.toml`; keep both
	# lists in sync, and drop an entry from both once it stops firing.
	run: \|
	uv export --format requirements-txt --no-hashes > requirements.txt
	pip-audit -r requirements.txt --disable-pip --no-deps

Navigation Menu