From 15e4cd868c73da141b9b5bb2298734064bf9f917 Mon Sep 17 00:00:00 2001
From: KineGrant Maintainer <maintainer@kinegrant.com>
Date: Wed, 19 Aug 2026 04:49:56 +0800
Subject: [PATCH] feat(ci): add weekly dependency vulnerability audit

---
 .github/workflows/dependency-audit.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/dependency-audit.yml

diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml
new file mode 100644
index 0000000..e0a340b
--- /dev/null
+++ b/.github/workflows/dependency-audit.yml
@@ -0,0 +1,26 @@
+name: dependency-audit
+
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"   # weekly, Monday 06:00 UTC
+
+permissions:
+  contents: read
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade pip
+      - name: Install
+        run: python -m pip install -e '.[test]'
+      - name: Audit dependencies
+        run: |
+          python -m pip install pip-audit
+          pip-audit -r <(python -c "import tomllib,sys; d=tomllib.load(open('pyproject.toml','rb')); print('\n'.join(d['project']['dependencies']))")
\ No newline at end of file