Initial commit - Ambient Code Reference Repository #1

	name: Security

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: "0 0 * * 0" # Weekly on Sunday

	jobs:
	security-scan:
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.11"

	- name: Install uv
	run: \|
	curl -LsSf https://astral.sh/uv/install.sh \| sh
	echo "$HOME/.cargo/bin" >> $GITHUB_PATH

	- name: Install dependencies
	run: \|
	uv pip install --system -r requirements-dev.txt

	- name: Run Bandit
	run: bandit -r app/ -f json -o bandit-report.json \|\| true

	- name: Upload Bandit report
	uses: actions/upload-artifact@v4
	with:
	name: bandit-report
	path: bandit-report.json

	- name: Run Safety
	run: safety check --json \|\| true

	- name: Check Bandit results
	run: \|
	if grep -q '"issue_severity": "HIGH"' bandit-report.json; then
	echo "HIGH severity security issues found"
	exit 1
	fi

Provide feedback