security.yml

name: Security

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]

jobs:
  gitleaks:
    uses: netresearch/.github/.github/workflows/gitleaks.yml@main

  dependency-review:
    if: github.event_name == 'pull_request'
    uses: netresearch/.github/.github/workflows/dependency-review.yml@main
    permissions:
      contents: read
      pull-requests: write

  sast:
    uses: netresearch/typo3-ci-workflows/.github/workflows/security.yml@main
    # The reusable's own Composer-audit job runs `composer install` on a hosted
    # runner with only the default GitHub token; it has no input/secret to pass
    # COMPOSER_AUTH, so it cannot authenticate to the private git.netresearch.de
    # source that provides netresearch/nr-ai-search (an internal-only extension,
    # never on Packagist). Its audit therefore stays skipped here; the dedicated
    # composer-audit job below runs the audit with the same COMPOSER_AUTH the
    # image build uses. This call keeps the reusable's Opengrep SAST running.
    with:
      skip-composer-audit: true

  # Composer dependency audit. Since NRS-4588 the repo commits composer.lock,
  # so the audit reads the same resolution the image and the declared SBOM are
  # built from — no ad-hoc resolve, and no COMPOSER_AUTH needed here. The
  # validate step is the freshness gate: it exits non-zero when composer.json
  # was changed without refreshing the lock, which would decouple the image
  # contents from the SBOM.
  composer-audit:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup PHP
        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
        with:
          php-version: '8.5'
          coverage: none

      - name: Verify composer.lock is in sync with composer.json
        run: composer validate --no-check-publish

      - name: Run Composer audit
        run: composer audit --locked --format=plain --abandoned=report