chore: documentation, dependencies, security and CI #1

	# Security audit of Python dependencies (known vulnerabilities)
	name: Dependency security

	on:
	push:
	branches: ["*"]
	pull_request:
	branches: ["*"]

	jobs:
	pip-audit:
	name: pip-audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Create venv and install
	run: \|
	python -m venv env
	source env/bin/activate
	pip install --upgrade pip pip-audit
	pip install "cbor2>=5.4.0" "cbor-diag>=1.1.0" "pycose>=1.0.1"
	pip install -r requirements-dev.txt

	# Exit 1 on any vulnerability (fail CI). --skip-editable whitelists pymdoccbor (local package, not on PyPI).
	# Ignore only unfixable: ecdsa CVE-2024-23342 (no upstream fix; see docs/SECURITY-DEPENDENCIES.md).
	- name: Run pip-audit (dependencies)
	run: \|
	source env/bin/activate
	pip-audit --skip-editable --ignore-vuln CVE-2024-23342

Provide feedback