security.yaml

---
# This workflow will install Python dependencies
# run tests and lint with a variety of Python versions
# For more information see:
# https://help.github.com/actions/language-and-framework-guides/using-python-with-github-actions

name: "⛔️ Security auditing (Matrix)"

# yamllint disable-line rule:truthy
on:
  workflow_dispatch:
  pull_request:
    types: [opened, reopened, edited, synchronize]
    branches:
      - "*"
      - "!update-devops-tooling"

jobs:
  get-python-versions:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.parse-project-metadata.outputs.python-matrix-versions }}

    steps:
      - uses: actions/checkout@v4

      - name: "Populate environment variables"
        id: parse-project-metadata
        # yamllint disable-line rule:line-length
        uses: os-climate/devops-reusable-workflows/.github/actions/python-versions-matrix@main

  builds:
    name: "Python builds"
    needs: [get-python-versions]
    runs-on: "ubuntu-latest"
    continue-on-error: true
    # Don't run when pull request is merged
    if: github.event.pull_request.merged == false
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.get-python-versions.outputs.matrix) }}

    steps:
      - name: "Checkout repository"
        uses: actions/checkout@v4

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Setup PDM for build commands"
        uses: pdm-project/setup-pdm@v4
        with:
          python-version: ${{ matrix.python-version }}

      - name: "Install dependencies"
        run: |
          pip install --upgrade pip
          pdm lock
          pdm export -o requirements.txt
          python -m pip install -r requirements.txt
          python -m pip install .
          pip install --upgrade setuptools
          pdm list --graph

      - name: "Run: pip-audit"
        uses: pypa/gh-action-pip-audit@v1.0.8