Ce 12885 add weeekly security audit

.github/workflows/weekly-security-audit.yml

@@ -0,0 +1,70 @@
+# Runs weekly security audits against the develop branch.
+# Executes yarn audit to check dependencies for known vulnerabilities
+# and vtk scan to check the repository for signs of active supply chain malware infection.
+
+name: '[Security] Weekly Security Audit'
+
+on:
+  schedule:
+    - cron: '0 8 * * 1' # Every Monday @ 8:00 AM UTC
+  workflow_dispatch:
+
+jobs:
+  # Commenting out until dependabot PRs are merged and we can be sure the audit runs without errors 
+  # yarn_audit:
+  #   name: Yarn Dependency Audit
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - name: Checkout develop branch
+  #       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+  #       with:
+  #         ref: develop
+
+  #     - name: Setup Node.js
+  #       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+  #       with:
+  #         node-version-file: 'VAMobile/.nvmrc'
+
+  #     - name: Install dependencies
+  #       uses: nick-fields/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4
+  #       with:
+  #         max_attempts: 3
+  #         timeout_minutes: 10
+  #         command: cd VAMobile && yarn install --ignore-scripts --frozen-lockfile --non-interactive
+
+  #     - name: Run yarn audit
+  #       run: yarn audit
+  #       working-directory: VAMobile
+
+  vtk_scan:
+    name: VTK Repository Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout develop branch
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: develop
+
+      - name: Setup Ruby
+        uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f
+        with:
+          ruby-version: '3.3'
+
+      - name: Install VTK
+        run: gem install vtk
+
+      - name: Run VTK scan
+        run: vtk scan repo -r
+
+  notify_slack:
+    name: Send Slack notification for security issues
+    needs: vtk_scan
+    if: ${{ failure() }}
+    uses: ./.github/workflows/start_slack_thread.yml
+    with:
+      channel_name: va-mobile-app-alerts
+      message: |
+        :rotating_light: Weekly Security Audit Failed :rotating_light:
+        *Branch:* develop
+        One or more security scans reported issues against the `develop` branch.
+        <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View workflow run for details>