security-scan.yml

# SPDX-License-Identifier: MPL-2.0

name: Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
  workflow_dispatch:

# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
# to the same ref don't pile up identical jobs in the queue.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  scan:
    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@485ca54610aa1ffc663639c5d43c39452f6897cc # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
    secrets:
      VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}