name: Security Scan
on: [push, pull_request]

permissions:
  contents: read
  security-events: write
  pull-requests: write
  packages: read

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Security Scan
        uses: cloudon-one/git-security-scanner-public@2.3
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          fail_on_critical: true
          scan_type: all
          create_pr_comment: true

      - name: Upload scan artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-scan-results-${{ github.run_number }}
          path: /tmp/security-scan-results/
          retention-days: 30

- uses: cloudon-one/git-security-scanner-public@2.3
  with:
    fail_on_critical: true
    create_pr_comment: true

- uses: cloudon-one/git-security-scanner-public@2.3
  id: security
  with:
    scan_type: all
    fail_on_critical: false
    repository_path: ./src

- name: Process Results
  if: always()
  run: |
    echo "Risk Level: ${{ steps.security.outputs.risk_level }}"
    echo "Secrets: ${{ steps.security.outputs.secrets_found }}"
    echo "Vulnerabilities: ${{ steps.security.outputs.vulnerabilities_found }}"
    echo "Misconfigurations: ${{ steps.security.outputs.misconfigurations_found }}"

name: Weekly Security Audit
on:
  schedule:
    - cron: '0 2 * * 1'  # Mondays at 2 AM
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  packages: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: cloudon-one/git-security-scanner-public@2.3
        with:
          fail_on_critical: false

- uses: cloudon-one/git-security-scanner-public@2.3
  with:
    scan_type: gitleaks
    fail_on_critical: true

- uses: cloudon-one/git-security-scanner-public@2.3
  with:
    scan_type: trivy
    fail_on_critical: false