security-check.yml

name: Security Check

# On all pushes to PRs or pushes to specific branches. Not on ALL pushes in general because it will
# double if pushing to a PR.
on:
  pull_request:
  push:
    branches:
      - 'master'
      - 'dev'

permissions:
  contents: read

jobs:
  check:

    runs-on: ubuntu-latest
    strategy:
      matrix:
        # NOTE: Keep at 3.13 until Bandit updates with 3.14 support!
        python-version: ['3.13']

    steps:
    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
    - name: Set up Python ${{ matrix.python-version }}
      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
      with:
        python-version: ${{ matrix.python-version }}
    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
      with:
        path: ~/.cache/pip
        key: ${{ runner.os}}-pip-${{ hashFiles('**/.*-requirements.txt') }}
        restore-keys: |
          ${{ runner.os}}-pip-
    - name: Security Check
      run: ./misc/actions/security-check.sh