ci: add non-blocking PySentry dependency audit

[nyudenkov]

Description

Adds .github/workflows/pysentry.yml — a non-blocking dependency vulnerability audit using PySentry. It parses uv.lock natively (no resolver, no dev-dependency added to pyproject.toml), uploads results as SARIF to the Security tab, and cross-checks three advisory databases (PyPA, PyPI, OSV). The job is continue-on-error: true, so it's advisory and never blocks a PR. The action and checkout are pinned by SHA to match your pinned-dependencies setup.

Related Issue

Follow-up to #1029 (pip-audit doesn't flag uv.lock dependencies).

Motivation and Context

#1029 found that pip-audit alone doesn't read uv.lock, so lockfile dependencies went unaudited. PySentry reads uv.lock directly, which covers that gap without changing project dependencies. Added as a separate, non-blocking job so it surfaces findings in the Security tab without gating CI.

How Has This Been Tested?

YAML validated locally. The workflow uses PySentry's official pinned GitHub Action; SARIF upload targets Code Scanning, which is already enabled here via CodeQL. Full behavior is visible on the first run of this PR (Actions run summary + Security tab).

Screenshots (if appropriate):

N/A

Types of changes

• New feature (non-breaking change which adds functionality)

AI Usage Disclosure

• ⭐ AI-assisted. Car analogy : you drive the car, AI help you find your way.

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the docs/how-to/contributing.md document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[nyudenkov]

@inimaz I also can add scan to the pre-commit if u want it :)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[inimaz]

Thanks a lot for this @nyudenkov ! Can you add the pre-commit indeed?
Does this action upload to the security tab? I was not able to see it. Thanks again!

[nyudenkov]

@inimaz hi!

done, and made it a bit nicer while at it:

• bumped the action to v0.5.0
• added a shared .pysentry.toml - it's the single source of truth for both this ci workflow and the pre-commit hook, so local and ci scans stay identical. it sets fail_on = "high" for production deps and loosens dev/doc groups to critical-only so tooling doesn't create noise
• added the pre-commit hook (pysentry/pysentry-pre-commit@v0.5.0, on pre-push since it resolves the whole dependency tree)

on the security tab: that's a fork-pr limitation, not a bug. v0.5.0 skips the upload on pull_request by default and prints findings in the job summary instead. the security-tab upload happens on the push: master run once merged