diff --git a/.gitea/workflows/pr-check.yml b/.gitea/workflows/pr-check.yml index 3bab168..735e4a8 100644 --- a/.gitea/workflows/pr-check.yml +++ b/.gitea/workflows/pr-check.yml @@ -1,12 +1,10 @@ name: PR Checks on: + push: + branches: ['**'] pull_request: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} - cancel-in-progress: true + branches: ['**'] concurrency: group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} @@ -92,24 +90,15 @@ jobs: env: UV_NO_PROGRESS: "1" run: | - echo "Running pip-audit on production dependencies..." - # Audit only production dependencies (exclude dev) - uv pip compile pyproject.toml --no-dev -o requirements-prod.txt - uv run pip-audit --format json --output audit-results.json -r requirements-prod.txt || true - - # Parse and display results - if [ -s audit-results.json ] && [ "$(cat audit-results.json)" != "[]" ]; then - echo "❌ Found vulnerabilities in production dependencies:" - uv run python -c " -import json -data = json.load(open('audit-results.json')) -for vuln in data: - print(f\" - {vuln.get('name', 'unknown')} {vuln.get('version', '')}: {vuln.get('id', '')}\") -" - exit 1 - else - echo "✅ No vulnerabilities in production dependencies" - fi + uv pip compile pyproject.toml --no-dev -o requirements-prod.txt && uv run pip-audit --format json --output audit-results.json -r requirements-prod.txt && test ! -s audit-results.json || test "$(cat audit-results.json)" = "[]" + + - name: Upload audit log + uses: actions/upload-artifact@v3 + if: failure() + with: + name: security-audit + path: audit-results.json + retention-days: 7 - name: Check for secrets run: |