security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1" # weekly Monday 06:00 UTC

# Cancel superseded runs on the same ref.
concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  deps:
    name: dependency scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v5

      - uses: actions/setup-node@v5
        with:
          node-version: 20
          cache: npm

      # .npmrc sets legacy-peer-deps=true, honoured by npm ci.
      - name: Install
        run: npm ci

      # Hard gate: fail CI on any HIGH+ advisory in the production dependency tree.
      # (Dev-only advisories — vitest/vite/form-data — are excluded via --omit=dev and don't
      # ship.) Moderate prod advisories are surfaced by the weekly schedule + Snyk/CodeQL but
      # don't block a merge.
      - name: npm audit (prod deps, high+)
        run: npm audit --audit-level=high --omit=dev

      - name: Snyk
        if: ${{ secrets.SNYK_TOKEN != '' }}
        uses: snyk/actions/node@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

  codeql:
    name: CodeQL (SAST)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: javascript-typescript

      - name: Analyze
        uses: github/codeql-action/analyze@v3