pulse/.github/workflows/security-scan.yml

name: Security Scan

# Build and Test audits dependencies on every push, but a quiet week with no
# pushes means no run — and newly disclosed vulnerabilities land against
# unchanged code. This schedule is the backstop: it re-scans every Go module
# and npm lockfile against the current advisory databases. A failed scheduled
# run emails the repository owner.
on:
  schedule:
    - cron: '30 5 * * 1' # weekly, Monday 05:30 UTC, before the 06:00 triage run
  workflow_dispatch:

permissions:
  contents: read

jobs:
  govulncheck:
    name: Go Vulnerability Scan (${{ matrix.directory }})
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        directory:
          - '.'
          - 'tests/integration/mock-github-server'
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: go.mod

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0

      - name: Scan Go module for reachable vulnerabilities
        working-directory: ${{ matrix.directory }}
        run: govulncheck ./...

  npm-audit:
    name: npm Dependency Audit (${{ matrix.name }})
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        include:
          - name: root tooling
            directory: '.'
          - name: product frontend
            directory: 'frontend-modern'
          - name: account frontend
            directory: 'internal/cloudcp/portal/frontend'
          - name: integration tests
            directory: 'tests/integration'
    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - name: Set up Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '20'

      - name: Audit complete dependency graph
        working-directory: ${{ matrix.directory }}
        run: npm audit --package-lock-only

      - name: Audit production dependencies
        working-directory: ${{ matrix.directory }}
        run: npm audit --package-lock-only --omit=dev