security.yml

# =============================================================================
# Security Scanning Workflow
# Runs gitleaks and other security checks on PRs and pushes
# =============================================================================

name: Security

on:
  push:
    branches: [master, main, 1.0.x]
  pull_request:
    branches: [master, main, 1.0.x]
  schedule:
    # Run weekly on Sundays at midnight
    - cron: '0 0 * * 0'

jobs:
  gitleaks:
    name: Gitleaks Secret Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        with:
          args: --config .gitleaks.toml --verbose
        env:
          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

  php-security:
    name: PHP Security Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          tools: composer

      - name: Check for vulnerable dependencies
        run: |
          if [ -f "composer.lock" ]; then
            composer audit
          else
            echo "No composer.lock found, skipping audit"
          fi