security.yml

name: Security checks

on:
  push:
    branches:
      - develop
      - main
  pull_request:
    branches:
      - develop
      - main

jobs:
  audit-and-secret-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 22.13.0
          cache: npm

      - name: Install dependencies
        run: npm ci

      - name: NPM audit (advisory on PRs)
        if: github.event_name == 'pull_request'
        run: |
          set +e
          npm audit --audit-level=moderate
          code=$?
          set -e
          if [ "$code" -ne 0 ]; then
            echo "::warning::npm audit reported vulnerabilities (advisory mode on PRs)."
          fi

      - name: NPM audit (enforced on push)
        if: github.event_name == 'push'
        run: npm audit --audit-level=critical

      - name: Trufflehog git history scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified