feat(ci): add pip-audit dependency vulnerability scanning to CI/CD

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.github/workflows/ci.yml

@@ -55,13 +55,38 @@ jobs:
         run: ruff format --check app/ tests/
 
   # ══════════════════════════════════════════════════════════════════════════
-  # Stage 2: Tests & Type Checking (run in parallel after lint passes)
+  # Stage 2a: Dependency Vulnerability Scan (runs in parallel with lint)
+  # ══════════════════════════════════════════════════════════════════════════
+
+  dependency-scan:
+    name: Dependency Vulnerability Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install pip-audit
+        run: pip install pip-audit>=2.7.0
+
+      - name: Run pip-audit on production dependencies
+        run: pip-audit -r requirements.txt --desc on
+
+      - name: Run pip-audit on dev dependencies
+        run: pip-audit -r requirements-dev.txt --desc on
+
+  # ══════════════════════════════════════════════════════════════════════════
+  # Stage 2b: Tests & Type Checking (run in parallel after lint passes)
   # ══════════════════════════════════════════════════════════════════════════
 
   test:
     name: Tests
     runs-on: ubuntu-latest
-    needs: [lint]  # Wait for lint to pass before running tests
+    needs: [lint, dependency-scan]  # Wait for lint and dependency scan before running tests
     services:
       redis:
         image: redis:7
@@ -128,7 +153,7 @@ jobs:
   mypy:
     name: Mypy
     runs-on: ubuntu-latest
-    needs: [lint]  # Wait for lint to pass before running type checks
+    needs: [lint, dependency-scan]  # Wait for lint and dependency scan before running type checks
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
@@ -153,7 +178,7 @@ jobs:
   build:
     name: Build & Push Docker Image
     runs-on: ubuntu-latest
-    needs: [test, lint, mypy]
+    needs: [test, lint, mypy, dependency-scan]
     if: github.event_name == 'push'
 
     steps: