actions

.github/workflows/security.yml

@@ -0,0 +1,51 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 5 * * 1"
+
+jobs:
+  codeql:
+    # PR depuis fork : pas d’upload SARIF vers le dépôt cible (permissions GitHub).
+    # Dépôt sans « Code scanning » activé (Settings → Code security) : l’upload échoue ;
+    # `upload: false` garde l’analyse CodeQL sans appeler l’API. Quand le scanning est
+    # activé sur le repo, retirer `upload: false` (comportement par défaut = upload).
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v4
+        with:
+          upload: false
+
+  deps-and-secrets:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Historique complet : gitleaks compare github.event.before..after sur push ;
+      # un clone depth=1 ne contient pas le parent, d’où « unknown revision ».
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - run: npm ci
+      - run: npm run audit:deps
+      - name: Secret scan
+        # v2 — SHA épinglé (supply chain) ; tag : https://github.com/gitleaks/gitleaks-action/releases
+        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}