security.yml

name: security

on:
  pull_request:
    branches: [master, main]
  push:
    branches: [master, main]
  schedule:
    - cron: "11 6 * * 1"

jobs:
  semgrep:
    name: semgrep
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: |
          semgrep scan --error --severity ERROR \
            --config p/javascript \
            --config p/typescript \
            --config p/owasp-top-ten \
            --config p/secrets

  npm-audit:
    name: npm audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
      - name: Audit (skip when no package.json)
        run: |
          if [ -f package.json ]; then
            (npm ci --no-audit --no-fund 2>/dev/null || npm install --no-audit --no-fund)
            npm audit --audit-level=high
          else
            echo "no package.json — skipping npm audit"
          fi

  gitleaks:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          VERSION=8.21.2
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /usr/local/bin gitleaks
          gitleaks version
      - name: Scan history
        run: gitleaks detect --source . --redact --verbose --no-banner --exit-code 1