# Nightly compliance scans — adapted from Engineering Standards Appendix E.
name: compliance-nightly
on:
  schedule:
    - cron: '17 3 * * *'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  nightly:
    runs-on: blacksmith-4vcpu-ubuntu-2404
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: '3.12'

      - name: Install dependencies
        run: pip install -e ".[dev]"

      - name: Dependency scan (pip)
        run: |
          pip install safety
          safety check --full-report || true

      - name: Container scan (Trivy full)
        uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284 # 0.34.0
        with:
          scan-type: 'fs'
          format: 'table'
          exit-code: '1'
          severity: 'HIGH,CRITICAL'

      - name: IaC scan (Checkov)
        run: |
          pip install checkov
          checkov --compact -d . --skip-check CKV_GHA_7

      - name: Full mutation testing
        continue-on-error: true  # Informational — mutmut 3.x has enum trampoline bugs
        run: |
          if [ -d tests ]; then pip install mutmut && mutmut run; fi
