Security Audit #5

	name: Security Audit

	on:
	pull_request:
	push:
	branches:
	- main
	- master
	schedule:
	- cron: "0 5 * * 1"

	jobs:
	dependency-audit:
	name: Dependency Audit
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup PHP
	uses: shivammathur/setup-php@v2
	with:
	php-version: "8.3"
	tools: composer
	extensions: mbstring, sqlite, pdo_sqlite

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "22"
	cache: npm

	- name: Install PHP dependencies
	run: composer install --no-interaction --no-progress --prefer-dist

	- name: Install Node dependencies
	run: npm ci --no-audit --fund=false

	- name: Run Composer Audit
	run: composer audit --no-interaction --abandoned=report

	- name: Run NPM Audit (production)
	run: npm audit --omit=dev --audit-level=high

	secret-scan:
	name: Secret Scan
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	sast:
	name: SAST
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Semgrep
	uses: returntocorp/semgrep-action@v1
	with:
	config: \|
	p/php
	p/owasp-top-ten
	p/secrets

Provide feedback