From b4932b5f273e5306eeac53748c7153573f0ef9bb Mon Sep 17 00:00:00 2001
From: rozling <1826422+rozling@users.noreply.github.com>
Date: Wed, 23 Sep 2026 01:15:17 +0300
Subject: [PATCH] fix: audit project dependencies in security workflow

---
 .github/workflows/security.yml | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 734648b..2a3ab6f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -4,6 +4,8 @@ name: Security
 on:
   push:
     branches: [ main ]
+  pull_request:
+    branches: [ main ]
   schedule:
     - cron: '0 0 * * 0'  # Weekly on Sunday
 
@@ -32,17 +34,13 @@ jobs:
       run: |
         safety check --file requirements.txt || true
 
-    - name: Install project dependencies first
-      run: |
-        pip install -r requirements.txt
-
     - name: Run pip-audit (fail on any vulnerability)
       run: |
-        pip-audit --desc
+        pip-audit -r requirements.txt --desc
 
     - name: Show detailed vulnerability information
       if: failure()
       run: |
         echo "Detailed vulnerability report:"
-        pip-audit --format json --desc | python3 -m json.tool || true
+        pip-audit -r requirements.txt --format json --desc | python3 -m json.tool || true
       continue-on-error: true