name: Security

# Scans run alongside CI on every PR and on pushes to the long-lived branches.
# This is the DETECTIVE layer (backstop). The PREVENTIVE layer is the local
# pre-commit hook — this catches anything that slipped past it (e.g. --no-verify)
# and scans the full history, not just the staged diff.
on:
  push:
    branches: [main, develop]
  pull_request:

jobs:
  secrets:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0            # full history so gitleaks scans every commit
      - name: Secret scan (gitleaks)
        run: |
          docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:latest \
            detect --source=/repo --redact --verbose --exit-code 1

  dependencies:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '8.0.x'
      - name: Restore
        run: dotnet restore InboxIntel.sln
      - name: .NET vulnerable packages (fail on any)
        run: |
          dotnet list InboxIntel.sln package --vulnerable --include-transitive 2>&1 | tee vuln.txt
          if grep -qiE 'Critical|High|Moderate|Low' vuln.txt; then
            echo "::error::Vulnerable NuGet packages detected — see the table above."
            exit 1
          fi
          echo "No vulnerable NuGet packages."
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: npm audit (fail on high/critical)
        working-directory: frontend
        run: npm audit --audit-level=high