fix(ai_mail): delivery learns the declared-roots external tier - the … #2389

	name: Security Scan

	on:
	push:
	branches: [main, dev]
	pull_request:
	branches: [main, dev]
	schedule:
	- cron: "0 6 * * 1"

	permissions:
	contents: read

	env:
	FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

	jobs:
	dependency-scan:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
	with:
	python-version: "3.13"
	# Upgrade pip first: pip-audit scans the whole environment, and the
	# runner's bundled pip (26.1.1) carries advisory PYSEC-2026-196 (fixed in
	# 26.1.2). Upgrading removes the vulnerable version outright rather than
	# suppressing it — and 26.1.2 also resolves CVE-2026-3219 / CVE-2026-6357,
	# which is why those two stale --ignore-vuln entries are no longer needed.
	# Both installs are hash-pinned (Scorecard: Pinned-Dependencies); pip.txt
	# holds the >=26.1.2 floor the comment above requires.
	- run: \|
	python -m pip install --require-hashes -r .github/requirements/pip.txt
	python -m pip install --require-hashes -r .github/requirements/audit.txt
	- run: pip install -e .
	- name: Pip audit
	run: pip-audit --skip-editable

	codeql:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	actions: read
	security-events: write
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
	with:
	languages: python
	- uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9

Navigation Menu