test(batch): add push/delete and media upload tests; docs/CI updates #67

	name: Security

	on:
	push:
	branches: [main, develop]
	pull_request:
	branches: [main, develop]
	schedule:
	# Run weekly on Monday at 00:00 UTC
	- cron: "0 0 * * 1"

	permissions:
	contents: read

	jobs:
	dependency-scan:
	name: Dependency Vulnerability Scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: "3.10"

	- name: Install dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	pip install pip-audit

	- name: Run pip-audit
	run: pip-audit --desc --skip-editable
	continue-on-error: true

	code-scan:
	name: Static Code Security Analysis
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: "3.10"

	- name: Install bandit
	run: \|
	python -m pip install --upgrade pip
	pip install bandit[toml]

	- name: Run bandit
	run: bandit -r src/ -c pyproject.toml -f json -o bandit-report.json
	continue-on-error: true

	- name: Display bandit results
	if: always()
	run: \|
	if [ -f bandit-report.json ]; then
	cat bandit-report.json
	fi

	- name: Run bandit (terminal output)
	run: bandit -r src/ -c pyproject.toml
	continue-on-error: true

Provide feedback