name: Scheduled Security Scan

on:
  schedule:
    - cron: "17 3 * * 1"
  workflow_dispatch:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Scan suspicious patterns
        run: |
          rg -n "eval\\(|new Function|innerHTML\\s*=|shell:\\s*true|LOCALHOST_BYPASS|coworker_token" apps packages docs || true

      - name: Scan secret-prone files
        run: |
          if find . -type f \( -name ".env" -o -name "*.pem" -o -name "*.pfx" -o -name "*.p12" -o -name "*.key" \) | rg .; then
            echo "Secret-prone file is tracked or present in workspace"
            exit 1
          fi

      - name: Install dependencies
        run: npm install

      - name: Audit
        run: npm run audit