hypatia-scan.yml

# SPDX-License-Identifier: MPL-2.0
#
# Standalone Hypatia security scan (push / PR / weekly). This is NOT a duplicate
# of the `hypatia-scan` job in `static-analysis-gate.yml`: that job exists to
# feed the gitbot-fleet LEARNING pipeline (via `deposit-findings`), whereas this
# workflow is the repo's independent security scan. Same tool, two consumers.
# See .github/workflows/README.adoc.
name: Hypatia Security Scan

on:
  push:
    branches: [main, master, develop]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 0 * * 0'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
permissions:
  contents: read
  security-events: write

jobs:
  scan:
    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9