security.yml

name: Security Scan
permissions:
  contents: read
  pull-requests: write
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    - cron: "0 0 * * 0" # Run weekly on Sunday at midnight

jobs:
  security_scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Setup Bun
        uses: oven-sh/setup-bun@v1

      - name: Install dependencies
        run: bun install

      - name: Run Security Audit
        run: bun audit --audit-level=high

      - name: Scan for Secrets
        uses: trufflesecurity/trufflehog@v3.93.6
        with:
          path: ./
          baseRef: ${{ github.event.pull_request.base.ref || github.ref }}
          headRef: ${{ github.event.pull_request.head.ref || github.sha }}