[Security hardening] Add automated security audit workflow #1

	name: Security Audit

	permissions:
	contents: read

	on:
	push:
	branches: ["main"]
	pull_request:
	schedule:
	- cron: "17 4 * * 1"
	workflow_dispatch:

	jobs:
	dependency-audit:
	name: Dependency audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Install uv
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
	with:
	python-version: "3.13"

	- name: Run pip-audit
	run: uvx pip-audit . --progress-spinner off

	static-analysis:
	name: Static analysis
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

	- name: Install uv
	uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
	with:
	python-version: "3.13"

	- name: Run Bandit
	# B602 is tracked in #2440; keep the baseline green until shell steps
	# require explicit opt-in.
	run: uvx bandit -r src -lll --skip B602

Provide feedback