security.yml

name: Security & Dependencies
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1' # Weekly Monday 8am UTC

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 'lts/*'
          cache: 'yarn'
      
      # Install dependencies for build and security checks
      - run: yarn install --immutable

      # Run comprehensive security and deployment verification
      # This includes: typecheck, build, and verification that webpack-dev-server
      # is excluded from production output (addressing GHSA-9jgg-88mc-972h, GHSA-4v9v-hfq4-rm2v)
      - run: yarn deploy:safe

      # Check for outdated dependencies (non-blocking)
      - run: yarn outdated || true