name: Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  schedule:
    - cron: '0 0 * * 0'  # Run weekly on Sunday at midnight

jobs:
  security_scan:
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v3

    - name: Use Node.js
      uses: actions/setup-node@v3
      with:
        node-version: '18'
        cache: 'npm'

    - name: Install Dependencies
      run: npm ci

    - name: Run Security Audit
      run: npm audit --audit-level=high

    - name: Scan for Secrets
      uses: trufflesecurity/trufflehog@v3.90.1
      with:
        path: ./
        baseRef: ${{ github.event.pull_request.base.ref || github.ref }}
        headRef: ${{ github.event.pull_request.head.ref || github.sha }}