Added security scanning

.gitea/workflows/pip-audit.yaml

@@ -0,0 +1,54 @@
+name: pip-audit
+on:
+  schedule:
+    - cron: "0 1 * * *"
+  push:
+    branches: [main]
+    paths: [requirements.txt, scripts/filter_requirements.py]
+  workflow_dispatch:
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest        # Docker runner, no mail access needed
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Audit dependencies
+        shell: bash
+        run: |
+          pip install pip-audit
+          python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt
+          pip-audit -r requirements.audit.txt --no-deps --disable-pip
+
+  notify:
+    needs: audit
+    if: ${{ always() && needs.audit.result == 'failure' }}
+    runs-on: host                 # runs directly on the server
+    steps:
+      - name: Send mail via local postfix
+        env:
+          MAIL_FROM: ${{ vars.MAIL_FROM }}
+          MAIL_TO:   ${{ vars.MAIL_TO }}
+          REPO:      ${{ gitea.repository }}
+          RUN_URL:   ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
+        run: |
+          python3 - <<'EOF'
+          import os, smtplib
+          from email.message import EmailMessage
+
+          msg = EmailMessage()
+          msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}"
+          msg["From"] = os.environ["MAIL_FROM"]
+          msg["To"] = os.environ["MAIL_TO"]
+          msg.set_content(
+              "The dependency audit failed (known vulnerability or job error).\n\n"
+              f"Details: {os.environ['RUN_URL']}\n"
+          )
+
+          with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
+              s.send_message(msg)
+          EOFq