Security #124

	# =============================================================================
	# Security Scanning Workflow
	# Runs gitleaks and other security checks on PRs and pushes
	# =============================================================================

	name: Security

	on:
	push:
	branches: [master, main, 1.0.x]
	pull_request:
	branches: [master, main, 1.0.x]
	schedule:
	# Run weekly on Sundays at midnight
	- cron: '0 0 * * 0'

	jobs:
	gitleaks:
	name: Gitleaks Secret Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Run Gitleaks
	uses: gitleaks/gitleaks-action@v2
	with:
	args: --config .gitleaks.toml --verbose
	env:
	GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

	php-security:
	name: PHP Security Check
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup PHP
	uses: shivammathur/setup-php@v2
	with:
	php-version: '8.3'
	tools: composer

	- name: Check for vulnerable dependencies
	run: \|
	if [ -f "composer.lock" ]; then
	composer audit
	else
	echo "No composer.lock found, skipping audit"
	fi

Provide feedback