name: Security Audit

on:
  schedule:
    - cron: "0 0 * * 0" # Weekly
  workflow_dispatch:

jobs:
  safety:
    runs-on: python-repositories-ci
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Sync dependencies
        env:
          UV_LINK_MODE: copy
          UV_INDEX_GITEA_USERNAME: ci-bot
          UV_INDEX_GITEA_PASSWORD: ${{ secrets.CI_RUNNER_TOKEN }}
        run: uv sync --frozen

      - name: Run safety check
        run: uv run safety check