Added security scanning and mail delivery

.gitea/workflows/pip-audit.yaml

@@ -1,7 +1,7 @@
 name: pip-audit
 on:
   schedule:
-    - cron: "0 1 * * *"
+    - cron: "0 5 * * *"
   push:
     branches: [main]
     paths: [requirements.txt, scripts/filter_requirements.py]
@@ -9,7 +9,9 @@ on:
 
 jobs:
   audit:
-    runs-on: ubuntu-latest        # Docker runner, no mail access needed
+    runs-on: ubuntu-latest
+    outputs:
+      report_b64: ${{ steps.audit.outputs.report_b64 }}
     steps:
       - uses: actions/checkout@v4
 
@@ -18,37 +20,59 @@ jobs:
           python-version: "3.12"
 
       - name: Audit dependencies
+        id: audit
         shell: bash
         run: |
           pip install pip-audit
           python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt
-          pip-audit -r requirements.audit.txt --no-deps --disable-pip
+
+          # Don't let a non-zero exit abort the step, so the report is saved first
+          set +e
+          pip-audit -r requirements.audit.txt --no-deps --disable-pip > audit.txt 2>&1
+          echo $? > audit.exit
+          set -e
+
+          cat audit.txt
+          echo "report_b64=$(head -c 100000 audit.txt | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+      - name: Fail if the audit failed
+        shell: bash
+        run: exit "$(cat audit.exit)"
 
   notify:
     needs: audit
     if: ${{ always() && needs.audit.result == 'failure' }}
-    runs-on: host                 # runs directly on the server
+    runs-on: host
     steps:
       - name: Send mail via local postfix
         env:
-          MAIL_FROM: ${{ vars.MAIL_FROM }}
+          MAIL_FROM:  ${{ vars.MAIL_FROM }}
-          MAIL_TO:   ${{ vars.MAIL_TO }}
+          MAIL_TO:    ${{ vars.MAIL_TO }}
-          REPO:      ${{ gitea.repository }}
+          REPO:       ${{ gitea.repository }}
-          RUN_URL:   ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
+          RUN_URL:    ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
+          REPORT_B64: ${{ needs.audit.outputs.report_b64 }}
         run: |
           python3 - <<'EOF'
-          import os, smtplib
+          import base64, os, smtplib
           from email.message import EmailMessage
 
+          b64 = os.environ.get("REPORT_B64", "")
+          report = (
+              base64.b64decode(b64).decode("utf-8", errors="replace")
+              if b64 else
+              "(no audit output, the job failed before pip-audit finished)"
+          )
+
           msg = EmailMessage()
           msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}"
           msg["From"] = os.environ["MAIL_FROM"]
           msg["To"] = os.environ["MAIL_TO"]
           msg.set_content(
-              "The dependency audit failed (known vulnerability or job error).\n\n"
+              f"pip-audit result for {os.environ['REPO']}:\n\n"
-              f"Details: {os.environ['RUN_URL']}\n"
+              f"{report}\n\n"
+              f"Run: {os.environ['RUN_URL']}\n"
           )
 
           with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
               s.send_message(msg)
-          EOFq
+          EOF