security.yml

# This workflow will run some security checks against our project

name: Security

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

jobs:
  osv-scanner:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/google/osv-scanner:v1.9.2
    steps:
      - uses: actions/checkout@v4
      - name: Run OSV Scanner
        run: |
          /osv-scanner --skip-git --format table -r .
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: returntocorp/semgrep:latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Semgrep
        run: |
          semgrep scan --config auto
  twyn:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.13"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install poetry
          poetry install --only main
      - name: Run Twyn against our dependencies
        run: |
          poetry run twyn --version
          poetry run twyn run -vv