# Dependency advisory scan.
#
# Lives in .github/workflows/ because Gitea Actions scans BOTH .gitea/workflows and
# .github/workflows, and e2e.yml already proves this instance resolves `actions/*` from GitHub
# (DEFAULT_ACTIONS_URL). Keeping one directory avoids a split where half the CI is invisible
# depending on which convention you look under.
#
# Unlike the GitHub-hosted runners this workflow does NOT assume a preinstalled Rust toolchain —
# the common Gitea runner images (gitea/runner-images, catthehacker/ubuntu) ship Node and Docker
# but not cargo. So we install it explicitly instead of relying on the ambient environment.
name: Audit

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # New advisories land against unchanged code, so a push-only trigger would never see them.
    - cron: '0 6 * * 1'

jobs:
  cargo-audit:
    name: cargo audit (backend)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        run: |
          if ! command -v cargo > /dev/null; then
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal
            echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
          fi

      - name: Cache cargo
        uses: actions/cache@v4
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/bin
          key: cargo-audit-${{ hashFiles('backend/Cargo.lock') }}
          restore-keys: cargo-audit-

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked || true

      # `rsa` 0.9 (RUSTSEC-2023-0071, "Marvin") is a transitive dep of the SQLx MySQL driver that
      # this app never exercises: auth is HS256 + bcrypt, and the only database is Postgres. There
      # is no patched release, so failing the build on it would mean a permanently red pipeline
      # that everyone learns to ignore — which is worse than not scanning at all. Ignore it
      # SPECIFICALLY, so that any OTHER advisory still fails the job.
      - name: Audit
        working-directory: ./backend
        run: cargo audit --deny warnings --ignore RUSTSEC-2023-0071

  npm-audit:
    name: npm audit (frontend)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Install deps
        working-directory: ./frontend
        run: npm install
      # Production dependencies only: a dev-only advisory (build tooling, test runners) can't be
      # reached by a guest at the party, and gating merges on it just trains people to skip the gate.
      - name: Audit
        working-directory: ./frontend
        run: npm audit --omit=dev --audit-level=high