[Security hardening] Add automated security audit workflow #5

	name: Security Audit

	permissions:
	contents: read

	on:
	push:
	branches: ["main"]
	pull_request:
	schedule:
	- cron: "17 4 * * 1"
	workflow_dispatch:

	jobs:
	dependency-audit:
	name: Dependency audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Install uv
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
	with:
	python-version: "3.13"

	- name: Run pip-audit
	run: \|
	uv pip compile pyproject.toml --extra test --quiet --output-file /tmp/spec-kit-audit-requirements.txt
	uvx --from pip-audit==2.10.0 pip-audit -r /tmp/spec-kit-audit-requirements.txt --progress-spinner off

	static-analysis:
	name: Static analysis
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Install uv
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
	with:
	python-version: "3.13"

	- name: Run Bandit
	run: uvx --from bandit==1.9.4 bandit -r src -lll --baseline .github/bandit-baseline.json

Provide feedback