name: Security Gates

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: '17 9 * * 3'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  codeql:
    name: CodeQL
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: javascript-typescript
          build-mode: none
          queries: security-extended
      - name: Analyze JavaScript and TypeScript
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: '/language:javascript-typescript'

  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    env:
      GITLEAKS_VERSION: 8.30.1
      GITLEAKS_LINUX_X64_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
      - name: Download verified gitleaks release
        shell: bash
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/gitleaks.tar.gz"
          curl --fail --silent --show-error --location \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            --output "$archive"
          echo "${GITLEAKS_LINUX_X64_SHA256}  ${archive}" | sha256sum --check --status
          tar -xzf "$archive" -C "$RUNNER_TEMP" gitleaks
      - name: Guard security workflow policy
        run: pnpm check:security-gates
      - name: Scan reviewed tree and test detection
        env:
          GITLEAKS_BIN: ${{ runner.temp }}/gitleaks
        run: pnpm check:gitleaks