name: CVE Lite dependency audit

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly on Monday at 06:00 UTC - catches new advisories between pushes
    - cron: '0 6 * * 1'

permissions:
  contents: read
  security-events: write

jobs:
  scan:
    name: Scan dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

      - name: Scan for vulnerabilities
        uses: OWASP/cve-lite-cli@2eed959b8641042472d2810444393b88d5454e62 # v1
        with:
          fail-on: high
          sarif: 'true'

      - name: Upload SARIF to Code Scanning
        if: always() && hashFiles('*.sarif') != ''
        uses: github/codeql-action/upload-sarif@411bbbe57033eedfc1a82d68c01345aa96c737d7 # v4
        with:
          sarif_file: cve-lite-*.sarif
          category: cve-lite