# Security vulnerability scanning for Donut Browser.
# Scans dependencies in package managers (npm/pnpm, Cargo) for known
# vulnerabilities on a weekly schedule and when dependencies change on main.
# https://google.github.io/osv-scanner/github-action/
#
# Pull requests and merge groups are scanned by the security-scan job in
# pr-checks.yml, which runs the same PR scan whenever a manifest or lockfile
# changes. This workflow used to run it a second time for the same PR.

name: Security Vulnerability Scan

on:
  schedule:
    # Run weekly on Tuesdays at 2:20 PM UTC
    - cron: "20 14 * * 2"
  push:
    branches: ["main"]
    paths:
      - "package.json"
      - "pnpm-lock.yaml"
      - "donut-sync/package.json"
      - "src-tauri/Cargo.toml"
      - "src-tauri/Cargo.lock"
      - "osv-scanner.toml"
      - ".github/workflows/osv.yml"

permissions:
  security-events: write
  contents: read
  actions: read

jobs:
  scan-scheduled:
    name: Scheduled Security Scan
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
    with:
      scan-args: |-
        -r
        --config=osv-scanner.toml
        --lockfile=pnpm-lock.yaml
        --lockfile=src-tauri/Cargo.lock
        ./