feat(workflows): add reusable python-audit workflow

[CybotTM]

Summary

New reusable workflow python-audit.yml for Python projects, modelled after node-audit.yml. Provides three independent jobs, each opt-outable:

• pip-audit — produces pinned requirements.txt from uv / poetry / pip, runs pip-audit against it.
• bandit — static analysis with configurable severity floor (all, medium, high); honours [tool.bandit] in pyproject.toml.
• sbom — syncs the project so cyclonedx-py environment sees real deps, generates CycloneDX JSON, uploads as artifact.

All steps SHA-pinned and hardened with step-security/harden-runner.

Inputs

Input	Default	Notes
python-version	3.14	Fallback when python-version-file is empty
python-version-file	''	e.g. pyproject.toml, .python-version
package-manager	uv	uv / poetry / pip
audit-level	high	pip-audit vulnerability floor
run-bandit	true
bandit-severity	medium	all / medium / high
bandit-target	auto	src/ if present, else .
generate-sbom	true
sbom-retention-days	90

Caller example

jobs:
  security:
    uses: netresearch/.github/.github/workflows/python-audit.yml@main
    permissions:
      contents: read
    with:
      python-version-file: pyproject.toml
      package-manager: uv

Test plan

• YAML validates (python3 -c "import yaml; yaml.safe_load(...)")
• Smoke-tested by wiring up netresearch/coding_agent_cli_toolset (PR #75 on that repo) to call @feat/python-audit-workflow first, then switch to @main once this merges.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

Adds a new reusable GitHub Actions workflow to run common Python security checks (dependency vulnerability audit, Bandit static analysis, and CycloneDX SBOM generation) for repositories that call it via workflow_call.

Changes:

• Introduces .github/workflows/python-audit.yml with three opt-in/opt-out jobs: pip-audit, bandit, and sbom.
• Supports multiple Python package managers (uv, pip, poetry) and optional Python version selection via an explicit version or version file.
• Uploads a generated CycloneDX SBOM as a workflow artifact.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.