security.yml

# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
# spell-checker: ignore gacts

# secret-scan runs on every push. It cannot be folded into the prek hook that
# CI already runs: the gitleaks hook scans the *staged* range, so on a clean CI
# checkout it scans zero bytes. This job, with fetch-depth: 0, is the only real
# secret gate in CI.
#
# dependency-audit is skipped on push. Its output only changes when the lock
# changes — which arrives as a Renovate pull request, covered below — or when a new
# advisory is published, which the weekly schedule catches.
#
# Container image scanning lives in container.yml.

name: Security

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]
  schedule:
    - cron: "0 3 * * 1"
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  secret-scan:
    name: Secret Scan
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Run gitleaks
        uses: gacts/gitleaks@c9a0338361dc45a01aa7ebaaa5330179f3c62873
        with:
          version: 8.30.1
          config-path: .github/gitleaks.toml

  dependency-audit:
    name: Dependency Audit
    # A skipped job costs no runner, so this gate is free.
    if: github.event_name != 'push'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@07a047e608db84b3d8c06cd9a7c7dcc9c355c18e # v10.3.2
        with:
          enable-cache: true
          cache-dependency-glob: uv.lock
      - run: uv audit --preview-features audit --locked --no-dev