From f5f10c6c9e2fba4dd8967c0173798a8b088f22ce Mon Sep 17 00:00:00 2001
From: Nikita Iudenkov <fmajesty@pm.me>
Date: Fri, 31 Jul 2026 02:40:21 +0200
Subject: [PATCH 1/2] ci: add non-blocking PySentry dependency audit

---
 .github/workflows/pysentry.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 .github/workflows/pysentry.yml

diff --git a/.github/workflows/pysentry.yml b/.github/workflows/pysentry.yml
new file mode 100644
index 000000000..b81fc4803
--- /dev/null
+++ b/.github/workflows/pysentry.yml
@@ -0,0 +1,23 @@
+# PySentry audits uv.lock natively and uploads findings to the Security tab.
+# continue-on-error keeps it advisory: it never blocks a PR.
+name: pysentry
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - name: PySentry audit
+      uses: nyudenkov/pysentry@cb212712ecbca50d7b873d52a87412e234d76123 # v0.4.9
+      with:
+        sources: pypa pypi osv

From ac16bf7e449405642d37fc6c2b5b225c89aca1d2 Mon Sep 17 00:00:00 2001
From: Nikita Iudenkov <fmajesty@pm.me>
Date: Fri, 21 Aug 2026 03:00:54 +0200
Subject: [PATCH 2/2] ci: pysentry v0.5.0 - shared .pysentry.toml config,
 pre-commit hook

---
 .github/workflows/pysentry.yml |  6 +++---
 .pre-commit-config.yaml        |  6 ++++++
 .pysentry.toml                 | 26 ++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)
 create mode 100644 .pysentry.toml

diff --git a/.github/workflows/pysentry.yml b/.github/workflows/pysentry.yml
index b81fc4803..937abdba0 100644
--- a/.github/workflows/pysentry.yml
+++ b/.github/workflows/pysentry.yml
@@ -1,5 +1,7 @@
 # PySentry audits uv.lock natively and uploads findings to the Security tab.
 # continue-on-error keeps it advisory: it never blocks a PR.
+# Sources, fail-on threshold and per-group policy live in .pysentry.toml,
+# which the pre-commit hook reads too, so CI and local scans stay identical.
 name: pysentry
 
 on:
@@ -18,6 +20,4 @@ jobs:
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: PySentry audit
-      uses: nyudenkov/pysentry@cb212712ecbca50d7b873d52a87412e234d76123 # v0.4.9
-      with:
-        sources: pypa pypi osv
+      uses: nyudenkov/pysentry@d351b9969fc6b9287347295245bcf5b13447e634 # v0.5.0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3cf06f6e3..980dafc4a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -26,3 +26,9 @@ repos:
           - id: flake8
             args: ["--config=.flake8"]
             additional_dependencies: ['flake8-bugbear==23.9.16']
+    - repo: https://github.com/pysentry/pysentry-pre-commit
+      rev: v0.5.0
+      hooks:
+          - id: pysentry
+            # Resolves the full dependency tree, so run on push rather than every commit.
+            stages: [pre-push]
diff --git a/.pysentry.toml b/.pysentry.toml
new file mode 100644
index 000000000..af9b685c2
--- /dev/null
+++ b/.pysentry.toml
@@ -0,0 +1,26 @@
+# PySentry configuration — https://pysentry.com
+# Single source of truth for BOTH the CI workflow (.github/workflows/pysentry.yml)
+# and the pre-commit hook, so local and CI scans behave identically.
+version = 1
+
+[defaults]
+# Block on high/critical; medium and below stay advisory.
+fail_on = "high"
+
+[sources]
+# Cross-check three advisory databases; findings are merged and de-duplicated.
+enabled = ["pypa", "pypi", "osv"]
+
+# Dev- and doc-only tooling is still scanned, but only critical issues should fail.
+# Anything ALSO reachable from production keeps the "high" floor set above — a group
+# can loosen below global only for packages exclusive to that group.
+[groups.dev]
+fail_on = "critical"
+
+[groups.doc]
+fail_on = "critical"
+
+# Mute individual advisories here once assessed, e.g.:
+# [ignore]
+# ids = ["GHSA-xxxx-xxxx-xxxx"]       # accepted risk or false positive
+# while_no_fix = ["PYSEC-2024-xxxx"]  # mute only until an upstream fix ships