security.yml

name: security
on:
    push:
    workflow_dispatch:
    schedule:
        - cron: "0 4 * * *" # run once a day at 4 AM

jobs:
    trivy-scan:
        runs-on: ubuntu-latest

        steps:
            - name: checkout-repository
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: run-trivy-dependency-scan
              uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
              with:
                  scan-type: fs
                  format: table
                  exit-code: "1"
                  vuln-type: "os,library"

    gitleaks:
        name: gitleaks
        runs-on: ubuntu-latest

        steps:
            - name: checkout-repository
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
              with:
                  fetch-depth: 0

            - name: run-gitleaks-scan
              uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    cargo-audit:
        name: cargo-audit
        runs-on: ubuntu-latest
        steps:
            - name: checkout-repository
              uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

            - name: setup-mise
              uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1

            - name: run-cargo-audit
              run: cargo audit