name: Security Scan

on:
  push:
    branches:
      - '**'
  pull_request:
  schedule:
    - cron: '0 3 * * 1'

permissions:
  contents: read

concurrency:
  group: security-scan-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  backend-security:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup Rust
        uses: dtolnay/rust-toolchain@eac0f66a48bc4b70a10b9acd4c4e930f835d95ff # 1.95
        with:
          toolchain: '1.95'

      - name: Cache Rust
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
        with:
          workspaces: backend -> target

      - name: Install cargo-audit
        run: cargo install cargo-audit --version 0.22.2 --locked

      - name: Run cargo audit
        working-directory: backend
        run: cargo audit

  frontend-security:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
        with:
          version: 11.7.0

      - name: Setup Node
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 24
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml

      - name: Install frontend dependencies
        run: pnpm --dir frontend install --frozen-lockfile

      - name: Run pnpm audit
        run: pnpm --dir frontend audit --prod --audit-level=high

  container-security:
    if: github.event_name == 'schedule'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.sha }}