name: Security

on:
  workflow_call:
    inputs:
      ref:
        description: Exact commit SHA to audit
        required: true
        type: string
  push:
    branches:
      - main
  pull_request:
    branches:
      - main
  schedule:
    - cron: '0 3 * * 1'

permissions:
  contents: read

concurrency:
  group: security-${{ github.workflow }}-${{ inputs.ref || github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
  cancel-in-progress: true

jobs:
  backend-security:
    runs-on: ubuntu-26.04
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}

      - name: Install cargo-audit
        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
        with:
          tool: cargo-audit@0.22.2
          fallback: none

      - name: Run Cargo audits
        run: |
          cargo-audit audit --file backend/Cargo.lock

  frontend-security:
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.sha }}

      - name: Setup pnpm
        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
        with:
          package_json_file: frontend/package.json

      - name: Read build toolchains
        id: toolchains
        run: ruby .github/scripts/toolchains.rb >> "$GITHUB_OUTPUT"

      - name: Setup Node
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: ${{ steps.toolchains.outputs.node }}
          cache: pnpm
          cache-dependency-path: frontend/pnpm-lock.yaml

      - name: Install frontend dependencies
        run: pnpm --dir frontend install --frozen-lockfile

      - name: Run pnpm audit
        run: pnpm --dir frontend audit --prod --audit-level=high

  container-security:
    if: github.event_name == 'schedule'
    permissions:
      contents: read
      security-events: write
    uses: ./.github/workflows/_container.yml
    with:
      ref: ${{ github.sha }}