fix: ExchangeStatus spec drift — add intra_exchange_transfers_active … #167

	name: pip-audit

	on:
	push:
	branches: [main]
	schedule:
	# Mondays at 07:00 UTC (one hour after spec-sync)
	- cron: "0 7 * * 1"
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	audit:
	runs-on: ubuntu-latest
	# Non-blocking initially — surfaces CVEs without gating PRs/main pushes.
	# Flip to false once the noise floor is established.
	continue-on-error: true
	steps:
	# Third-party actions pinned to SHA per #93 precedent.
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Install uv
	uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0

	- name: Set up Python
	run: uv python install 3.12

	- name: Install dependencies
	run: \|
	uv sync
	# `uv sync` does not seed `pip` into the venv (uv has its own
	# resolver). pip-audit needs `pip` to introspect installed packages.
	uv pip install pip

	- name: Run pip-audit
	uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266 # v1.1.0
	with:
	# Audit the resolved environment created by `uv sync`.
	virtual-environment: .venv

Provide feedback