name: Security Scanning

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

jobs:
  audit:
    name: pnpm audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: pnpm/action-setup@v6

      - uses: actions/setup-node@v7
        with:
          node-version: 22
          cache: pnpm

      - run: pnpm install --frozen-lockfile
      - run: pnpm audit --audit-level=high

  trivy-fs:
    name: Trivy filesystem scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Run Trivy filesystem scan
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          scanners: secret
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: 1
          format: table

  trivy-image:
    name: Trivy Docker image scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Build Docker image
        run: docker build -t agentlens:scan .

      - name: Run Trivy image scan
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          image-ref: agentlens:scan
          vuln-type: os
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          exit-code: 1
          format: table