From c7c42f87e414e572cbfba0b3d5d40ec60065f37e Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sun, 23 Aug 2026 14:40:01 +0100
Subject: [PATCH] Add a weekly scheduled dependency vulnerability scan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build and Test audits npm dependencies on every push, but nothing scans the
Go module for known vulnerabilities and neither surface is re-checked when
no pushes happen — which is exactly when a newly disclosed advisory against
unchanged code goes unnoticed. Run govulncheck and both npm audits weekly on
a schedule so a failed run emails the maintainer.
---
 .github/workflows/security-scan.yml | 60 +++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 .github/workflows/security-scan.yml

diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
new file mode 100644
index 000000000..2c97c94be
--- /dev/null
+++ b/.github/workflows/security-scan.yml
@@ -0,0 +1,60 @@
+name: Security Scan
+
+# Build and Test audits dependencies on every push, but a quiet week with no
+# pushes means no run — and newly disclosed vulnerabilities land against
+# unchanged code. This schedule is the backstop: it re-scans the Go module
+# (which has no push-time vulnerability gate at all) and the frontend
+# dependency graph against the current advisory databases. A failed scheduled
+# run emails the repository owner.
+on:
+  schedule:
+    - cron: '30 5 * * 1' # weekly, Monday 05:30 UTC, before the 06:00 triage run
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: Go Vulnerability Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
+
+      - name: Scan Go module for reachable vulnerabilities
+        run: govulncheck ./...
+
+  npm-audit:
+    name: Frontend Dependency Audit
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '20'
+          cache: npm
+          cache-dependency-path: frontend-modern/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend-modern
+        run: npm ci
+
+      - name: Audit complete frontend dependency graph
+        working-directory: frontend-modern
+        run: npm audit
+
+      - name: Audit production frontend dependencies
+        working-directory: frontend-modern
+        run: npm audit --omit=dev