name: Security

on:
  pull_request:
    branches: [ develop, main ]
  push:
    branches: [ develop, main ]
  schedule:
    - cron: '24 19 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  dependency-review:
    name: Dependency Review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Review dependency changes
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: high

  scorecard:
    name: Scorecard
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@v2.4.3
        with:
          results_file: scorecard.sarif
          results_format: sarif
          publish_results: false

      - name: Upload Scorecard results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: scorecard.sarif