ci: add dependency audit workflow

[PascalThuet]

Part of splitting #2442 into smaller, dedicated PRs. Rebased onto current main.

What

• Add a deterministic dependency-audit job for pull requests, pushes, and manual runs.
• Add a weekly live-resolution audit across Ubuntu and Windows with Python 3.11 through 3.14.
• Audit a committed, fully hashed requirements snapshot with pip-audit --require-hashes.
• Add a sync gate that regenerates the dependency set when relevant inputs change and fails with actionable diagnostics when the snapshot is stale.
• Document the local refresh and audit commands.

Security review feedback

The audit feedback is covered by the current branch:

• checkout uses full history so dependency diff bases are available;
• a missing GENERATED_REQUIREMENTS value produces an explicit error;
• actions/setup-python matches the repository-standard pinned SHA;
• astral-sh/setup-uv now also matches the repository-standard pinned SHA;
• the scheduled matrix includes Python 3.14 from the current CI lifecycle.

The existing review threads are outdated; they were intentionally left for the reviewer or PR author to resolve.

Failed workflow root cause

The previous Dependency audit check correctly detected that the committed requirements snapshot no longer matched a fresh resolution. The snapshot has been regenerated from current main and the sync gate now accepts it.

Validation

• Security workflow and static workflow tests: 17 passed
• Ruff on source and changed security files: passed
• Full test suite: 4,446 passed, 112 skipped
• Snapshot sync gate against origin/main...HEAD: passed
• pip-audit against the hashed snapshot: no known vulnerabilities found
• git diff --check: passed

Bandit and secret scanning remain intentionally outside this focused PR.

Disclosure: Updated on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

[Copilot]

Pull request overview

Adds a dedicated GitHub Actions “Security Audit” workflow to run deterministic pip-audit checks on PRs/push/manual runs (using a committed, hashed requirements snapshot) and a scheduled job that resolves/audits dependencies live across the supported OS/Python matrix. It also introduces a sync-gate script and corresponding tests/docs to keep the committed snapshot aligned with pyproject.toml.

Changes:

• Added .github/workflows/security.yml with split triggers: deterministic audit for PR/push/manual + scheduled live-resolution audit matrix.
• Added .github/scripts/check_security_requirements.py and a committed hashed requirements snapshot to gate PRs when dependency inputs change without regenerating the snapshot.
• Added tests + CONTRIBUTING docs to enforce and document the workflow, pins, and local commands.

Show a summary per file

File	Description
.github/workflows/security.yml	New Security Audit workflow with deterministic and scheduled dependency-audit jobs.
.github/scripts/check_security_requirements.py	Sync-gate script to detect dependency input changes and verify the committed snapshot is current.
.github/security-audit-requirements.txt	Committed hashed requirements snapshot used for deterministic audits.
tests/test_security_workflow.py	Static tests guarding workflow triggers, pins, matrix, and sync-gate behavior.
CONTRIBUTING.md	Documentation for local security audit and snapshot refresh commands.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 2

[mnriem]

Please address Copilot feedback

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Low

[mnriem]

Please address Copilot feedback

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Low

[mnriem]

Please address Security Audit workflow

[PascalThuet]

Security audit review summary

Audit feedback addressed

• Full checkout history keeps dependency diff bases available.
• Missing GENERATED_REQUIREMENTS configuration now fails with an actionable message.
• setup-python and setup-uv use the repository-standard pinned SHAs.
• The scheduled audit matrix now covers Python 3.11, 3.12, 3.13, and 3.14 on Ubuntu and Windows.

Failed check resolution

The previous Dependency audit failure was caused by a genuinely stale committed requirements snapshot. It has been regenerated from current main, and the sync gate now accepts it.

Validation

• Security/static workflow tests: 17 passed
• Full suite: 4,446 passed, 112 skipped
• Ruff: passed
• Snapshot sync gate: passed
• pip-audit: no known vulnerabilities found
• git diff --check: passed

Head commit: 6c6ab78

---

Posted on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

[PascalThuet]

@mnriem

One maintenance-policy question surfaced while rebasing this PR: pyproject.toml still declares Python >=3.11, while the functional CI matrix currently tests only Python 3.13 and 3.14. The scheduled security audit covers 3.11 through 3.14.

Could you confirm whether Python 3.11 and 3.12 remain officially supported, or are merely installable without CI guarantees?

Depending on the intended policy, we could either retain 3.11–3.14 in the scheduled audit or align it with the functional CI matrix.

Separately, the rebase exposed version drift for pinned actions between workflows (setup-uv v8.2.0 versus the repository-standard v8.3.2). This PR now aligns them, but a shared consistency check or documented convention could prevent future drift

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Medium

[PascalThuet]

Addressed the latest Copilot review round.

The contributor guidance now explicitly describes the pip-audit command as auditing the committed snapshot and requires dependency changes to refresh and commit that snapshot before auditing. I also regenerated the snapshot to incorporate platformdirs 4.11.0, which fixes the current dependency-audit sync failure.

Validation: 17 security/workflow tests passed; the snapshot sync gate passed; pip-audit reported no known vulnerabilities; git diff --check passed. Markdownlint still reports two pre-existing fence-style findings at CONTRIBUTING.md:180 and CONTRIBUTING.md:194, outside this change.

Commit: 7032366caaf5e1c492d6777999882124f9e2a37f

Posted on behalf of @PascalThuet by Codex (model: GPT-5, autonomous).

[Copilot]

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Medium

[mnriem]

@mnriem

One maintenance-policy question surfaced while rebasing this PR: pyproject.toml still declares Python >=3.11, while the functional CI matrix currently tests only Python 3.13 and 3.14. The scheduled security audit covers 3.11 through 3.14.

Could you confirm whether Python 3.11 and 3.12 remain officially supported, or are merely installable without CI guarantees?

They are supported indeed without direct CI guarantee. If a bug shows up, we will fix it. As those 2 versions are already security fixes only from Python perspective, we do not anticipate that to occur regularly.

Depending on the intended policy, we could either retain 3.11–3.14 in the scheduled audit or align it with the functional CI matrix.

If it does not cause extra churn include 3.11 and 3.12

Separately, the rebase exposed version drift for pinned actions between workflows (setup-uv v8.2.0 versus the repository-standard v8.3.2). This PR now aligns them, but a shared consistency check or documented convention could prevent future drift

The alignment will be forced by updates needed for the GitHub agentic workflows on the one hand and the Dependabot fixes on the other hand

[mnriem]

Thank you!