--- #6181

	name: CVE scan

	on:
	push:
	pull_request:
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	cve_scan:
	name: CVE scan on dependencies
	runs-on: ubuntu-22.04
	timeout-minutes: 10
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@a4aa98b93cab29d9b1101a6143fb8bce00e2eac4 # v2.7.1
	with:
	egress-policy: audit

	- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
	- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
	with:
	python-version: '3.11'
	cache: 'pip'
	cache-dependency-path: '**/requirements.txt'
	- name: Get date
	id: get-date
	run: \|
	echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
	- name: Get cached database
	uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
	with:
	path: cache
	key: Linux-cve-bin-tool-${{ steps.get-date.outputs.date }}
	- name: Install dependencies and cve-bin-tool
	run: \|
	python -m pip install --upgrade pip
	python -m pip install --upgrade setuptools
	python -m pip install --upgrade wheel
	python -m pip install --upgrade pytest
	pip install . -r doc/requirements.txt
	[[ -e cache ]] && mkdir -p .cache && mv -f cache .cache/cve-bin-tool
	sleep 5
	- name: Test to check for CVEs for Python requirements and HTML report dependencies
	run: \|
	pytest test/test_requirements.py

Provide feedback