.github/workflows/security-scan.yml

name: Security Scan

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master, develop ]
  schedule:
    # Run weekly on Monday at 00:00 UTC
    - cron: '0 0 * * 1'

jobs:
  security-scan:
    name: Security Vulnerability Scan
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: "3.11"
        cache: 'pip'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install safety bandit pip-audit

    - name: Run Safety check
      continue-on-error: true
      run: |
        pip install -e .
        safety check --json || true

    - name: Run Bandit security scan
      continue-on-error: true
      run: |
        bandit -r src/ -f json -o bandit-report.json || true
        bandit -r src/ -f txt || true

    - name: Run pip-audit
      continue-on-error: true
      run: |
        pip-audit --desc || true

    - name: Upload Bandit report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: bandit-security-report
        path: bandit-report.json
        if-no-files-found: ignore