name: Security Scanning

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  schedule:
    - cron: '0 0 * * 1'  # Weekly on Monday

jobs:
  dependency-scan:
    name: Dependency Security Scan
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install uv
      uses: astral-sh/setup-uv@v7

    - name: Install dependencies
      run: uv sync --extra dev

    - name: Run pip-audit (vulnerability scanner)
      run: |
        uv run pip-audit --desc || true

  code-scan:
    name: Code Security Scan
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install uv
      uses: astral-sh/setup-uv@v7

    - name: Install dependencies
      run: uv sync --extra dev

    - name: Run bandit security scan
      run: |
        uv run bandit -r ondine/ -c pyproject.toml || true

  secrets-scan:
    name: Scan for Leaked Secrets
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: TruffleHog OSS
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        extra_args: --only-verified

  license-check:
    name: License Compliance
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'

    - name: Install uv
      uses: astral-sh/setup-uv@v7

    - name: Install dependencies
      run: uv sync --extra dev

    - name: Check licenses
      run: |
        uv run pip-licenses --format=markdown || true
