Merge branch 'fix/checkov-github-actions-only' into dev #68

	name: Security Scans

	on:
	pull_request:
	branches:
	- dev
	- staging
	- preprod
	- master
	push:
	branches:
	- dev
	- staging
	- preprod
	- master
	schedule:
	- cron: "15 5 * * 1"
	workflow_dispatch: {}

	jobs:
	security-scans:
	name: Repository Security Scans
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: "3.14"
	cache: "pip"

	- name: Set up uv
	uses: astral-sh/setup-uv@v5
	with:
	version: "0.8.15"
	enable-cache: true

	- name: Create security virtual environment
	run: uv venv .venv-security

	- name: Install pinned security dependencies
	run: \|
	source .venv-security/bin/activate
	uv pip install -r security/requirements-security.txt
	shell: bash

	- name: Run security scan orchestrator
	run: \|
	source .venv-security/bin/activate
	python security/run_security_scans.py
	shell: bash

	- name: Upload security findings artifact
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: security-findings-${{ github.run_id }}
	path: .artifacts/security/
	if-no-files-found: warn

Navigation Menu