Repository navigation

Modernize cloud and Ollama model settings #35

	name: Security

	on:
	push:
	pull_request:
	schedule:
	# Weekly, so newly-disclosed CVEs against pinned versions still get caught even when
	# nothing in the repo has changed.
	- cron: "17 6 * * 1"

	jobs:
	pip-audit:
	runs-on: windows-latest

	steps:
	- name: Check out repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Set up Python
	uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: "3.12"

	- name: Audit dependencies
	uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
	with:
	inputs: requirements.txt

	sbom:
	# anchore/sbom-action shells out to syft via WSL on Windows runners, which
	# windows-latest does not have installed - runs natively on Linux, and this job only
	# introspects the dependency manifest, so it doesn't need Windows at all.
	runs-on: ubuntu-latest
	# The repo's default workflow token permissions are read-only, which blocks the
	# artifact-container creation the action needs to upload the SBOM - grant it here
	# rather than loosening the repo-wide default.
	permissions:
	contents: read
	actions: write

	steps:
	- name: Check out repository
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Generate SBOM
	uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
	with:
	path: .
	format: cyclonedx-json
	artifact-name: graphlink-sbom