# Security checks — ADVISORY by default (they report, they don't block the merge).
# Scaffolded by ContextDevKit (/security-setup). To ENFORCE: mark a job a required
# status check in branch protection, or remove its `continue-on-error`.
name: security

on:
  pull_request:
  push:
    branches: [main, master]
  workflow_dispatch:
  # OPT-IN (ADR-0047 A4): uncomment to run the alert-sync job on a cadence.
  # schedule:
  #   - cron: "0 6 * * 1" # Mondays 06:00 UTC

permissions:
  contents: read
  security-events: write # CodeQL uploads results here

jobs:
  dependency-review:
    # GitHub's native diff of dependency changes on a PR (CVEs + license).
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    continue-on-error: true # advisory — remove to block on a vulnerable bump
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
        with:
          fail-on-severity: high

  deps-audit:
    # ContextDevKit's deterministic supply-chain check (lockfile, pinning, license, CVEs).
    runs-on: ubuntu-latest
    continue-on-error: true # advisory — remove to block
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 20
      - run: node contextkit/tools/scripts/deps-audit.mjs

  alert-sync:
    # Scheduled run of the kit's on-demand alert sync (gh-alerts.mjs): prints open
    # Dependabot + code-scanning alerts as deps-audit-shaped findings in the job
    # log. INERT until the `schedule:` trigger above is uncommented (ADR-0047 A4);
    # runs in the project's CI, never on the kit hot path (rule 1). Note: reading
    # Dependabot alerts with the default GITHUB_TOKEN may be denied — the script
    # then reports nothing and exits 0 (skip, never a fake pass). To retain a
    # review artifact, run locally: gh-alerts.mjs --write.
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    continue-on-error: true
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: 20
      - run: node contextkit/tools/scripts/gh-alerts.mjs

  codeql:
    # SAST. Set `language` to your stack: c-cpp, csharp, go, java-kotlin,
    # javascript-typescript, python, ruby, swift. Remove this job if you enable
    # CodeQL "default setup" in repository settings instead.
    runs-on: ubuntu-latest
    continue-on-error: true
    strategy:
      matrix:
        language: ["javascript-typescript"]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
        with:
          languages: ${{ matrix.language }}
      - uses: github/codeql-action/autobuild@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
      - uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3