name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 9 * * 1'  # Weekly on Monday

permissions:
  contents: read

jobs:
  secrets-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Detect secrets
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./

  dependency-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: NPM Audit
        # --omit=dev: only ship-time deps gate the build. Dev-only tooling
        # (shadcn CLI and its transitive tree: hono, fast-uri, …) is never
        # bundled or served, so its advisories must not fail release CI.
        run: cd frontend && npm audit --omit=dev --audit-level=high
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - name: Pip audit
        run: pip install pip-audit && pip-audit -r backend/requirements.txt