Landing page: SEO, GA4 with consent, publish robots/sitemap #241

	name: Security Scan

	on:
	push:
	branches: [main, main_deprecated, ship_v1.0, v1, feature]
	pull_request:
	branches: [main, main_deprecated, ship_v1.0, v1, feature]
	schedule:
	- cron: '0 0 * * 0' # weekly

	jobs:
	pip-audit:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Set up Python
	uses: actions/setup-python@v6
	with:
	python-version: '3.11'
	cache: 'pip'

	- name: Install pip-audit
	run: \|
	python -m pip install --upgrade pip
	pip install pip-audit

	- name: Audit production dependencies (Step 15)
	run: \|
	# CVE-2026-4539 (Pygments): no fixed release on PyPI yet (latest 2.19.2); transitive e.g. via pytest.
	pip-audit -r requirements.txt --ignore-vuln CVE-2026-4539

	- name: Audit pinned build dependencies
	run: \|
	pip-audit -r requirements-build.txt --ignore-vuln CVE-2026-4539

	- name: Audit development dependencies
	run: \|
	pip-audit -r requirements-dev.txt --ignore-vuln CVE-2026-4539

Provide feedback