security.yml

name: Security Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly on Monday at 00:00 UTC
    - cron: '0 0 * * 1'
  workflow_dispatch:

jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install bandit[toml] safety

    - name: Run Bandit security scan
      run: |
        bandit -c .bandit -r src/ empathy_llm_toolkit/ coach_wizards/ empathy_software_plugin/ --format json --output bandit-report.json --severity-level medium --confidence-level medium || true

    - name: Upload Bandit results
      uses: actions/upload-artifact@v4
      with:
        name: bandit-results
        path: bandit-report.json

    - name: Check dependencies for vulnerabilities
      run: |
        safety check --json --output safety-report.json || true

    - name: Upload Safety results
      uses: actions/upload-artifact@v4
      with:
        name: safety-results
        path: safety-report.json