Phase 2 Modernization: httpx2, Pydantic v2, Retry Engine, and Security Guards #99
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Continuous Security Verification | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '37 3 * * 0' # Run weekly on Sundays to catch newly published CVEs | |
| permissions: | |
| contents: read | |
| jobs: | |
| static-analysis: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v5 | |
| with: | |
| python-version: "3.14" | |
| cache: 'pip' | |
| - run: python -m pip install --upgrade pip | |
| - run: pip install ruff bandit mypy pip-audit | |
| # Fast checks | |
| - run: ruff check . | |
| - run: bandit -c pyproject.toml -r mailgun | |
| - run: mypy --strict mailgun | |
| semgrep: | |
| runs-on: ubuntu-latest | |
| container: | |
| # Official Semgrep Docker image | |
| image: semgrep/semgrep | |
| # Skip any PR created by dependabot to avoid permission issues (Per Semgrep docs) | |
| if: (github.actor != 'dependabot[bot]') | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - name: Run Semgrep CE scan | |
| run: >- | |
| semgrep scan | |
| --config "p/python" | |
| --config "p/owasp-top-ten" | |
| --config "p/supply-chain" | |
| --config "p/command-injection" | |
| --config "p/insecure-transport" | |
| --error | |
| pip-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v5 | |
| with: { python-version: "3.14" } | |
| - run: python -m pip install --upgrade pip | |
| - run: pip install pip-audit | |
| - run: pip-audit --strict | |
| osv-scan: | |
| permissions: | |
| actions: read | |
| security-events: write # For Security Tab | |
| contents: read | |
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" | |
| with: | |
| # Explicit root scanning | |
| scan-args: |- | |
| --recursive | |
| ./ |