security.yml

# Phase 5.5: filesystem vulnerability scan with Trivy.
#
# Scans the repository for HIGH and CRITICAL vulnerabilities
# (OS packages, language-specific deps, and misconfigurations)
# on every pull request. Results appear inline in the PR check UI.
# Fails the workflow if any HIGH/CRITICAL issue is found.
#
# Does NOT run on push to main (those commits were already scanned
# at PR time). Trivy's local DB cache is saved as a GitHub Actions
# cache keyed on the OS image version so subsequent runs download
# only incremental updates (~2-3 s instead of ~30 s).

name: Security scan

on:
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  trivy-fs:
    name: Trivy filesystem scan
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Cache Trivy vulnerability DB
        uses: actions/cache@v4
        with:
          path: .cache/trivy
          key: trivy-${{ runner.os }}-${{ hashFiles('**/uv.lock', '**/pnpm-lock.yaml') }}

      - name: Run Trivy (fs, HIGH+CRITICAL)
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          format: table
          severity: HIGH,CRITICAL
          vuln-type: os,library
          cache-dir: .cache/trivy
          exit-code: 1
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:latest

      - name: Security scan summary
        if: success()
        run: |
          cat <<'EOF' >> $GITHUB_STEP_SUMMARY
          ## 🔒 Security scan results

          | Check | Status |
          |-------|--------|
          | Trivy filesystem scan | ✅ (0 HIGH/CRITICAL) |
          EOF