security.yml

name: Security Scans

on:
  push:
    branches: [main]
  pull_request:

jobs:
  npm-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm audit --audit-level=high

  codeql:
    name: CodeQL analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      security-events: write
    steps:
      - uses: actions/checkout@v6
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      - name: Run CodeQL
        uses: github/codeql-action/analyze@v4

  secrets-scan:
    name: Secrets scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}