security.yml

name: Security Audit

on:
  schedule:
    # Run every Monday at 9:00 AM UTC
    - cron: '0 9 * * 1'
  workflow_dispatch:
  pull_request:
    paths:
      - '**/package.json'
      - '**/package-lock.json'

jobs:
  audit:
    name: NPM Audit
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Run NPM Audit
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Check for known vulnerabilities
        run: |
          npm ci
          npm audit --audit-level=high

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: moderate