name: Security

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "0 5 * * 1"

jobs:
  codeql:
    # PR depuis fork : pas d’upload SARIF vers le dépôt cible (permissions GitHub).
    # Dépôt sans « Code scanning » activé (Settings → Code security) : l’upload échoue ;
    # `upload: false` garde l’analyse CodeQL sans appeler l’API. Quand le scanning est
    # activé sur le repo, retirer `upload: false` (comportement par défaut = upload).
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
      - uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript
      - uses: github/codeql-action/analyze@v4
        with:
          upload: false

  deps-and-secrets:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      # Historique complet : gitleaks compare github.event.before..after sur push ;
      # un clone depth=1 ne contient pas le parent, d’où « unknown revision ».
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v7
        with:
          node-version: 22
      - run: npm ci
      - run: npm run audit:deps
      - name: Secret scan
        # v2 — SHA épinglé (supply chain) ; tag : https://github.com/gitleaks/gitleaks-action/releases
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}