security-scan.yml

name: Security Scan

on:
    push:
        branches: [main]
    pull_request:
    merge_group:

concurrency:
    group: security-scan-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

permissions:
    contents: read

jobs:
    gitleaks:
        name: Gitleaks Secret Scan
        runs-on: ubuntu-latest
        # A HARD gate, deliberately. dev-health-ops runs this scan with
        # continue-on-error because it carries history that predates the scan;
        # this repo starts clean, so an allowed-to-fail secret scan here would
        # be a dead guard. Needs `GITLEAKS_LICENSE` (organization repositories):
        # if the org secret is not visible to this repo, grant it rather than
        # softening the gate.
        permissions:
            contents: read
            security-events: write
            pull-requests: write
        steps:
            - name: Checkout repository
              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
              with:
                  # Gitleaks scans the PR's commit RANGE, not just the tree, so
                  # the full history must be present.
                  fetch-depth: 0

            - name: Run Gitleaks
              uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                  GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

    audit:
        name: Dependency Audit
        runs-on: ubuntu-latest
        steps:
            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
              with:
                  node-version-file: .nvmrc
                  cache: pnpm
            - run: pnpm install --frozen-lockfile
            - run: pnpm audit --audit-level=high --prod