name: CI · Security

# Reusable stage 1 - security: dependency vulnerability scanning (OWASP). Called by ci.yml.
# Blocks on vulnerable *production* dependencies; dev/build-tooling vulnerabilities are
# surfaced but non-blocking (they never ship). The Python-side audits (pip-audit, bandit)
# retired with the Python toolchain (#806) - apps/api is retired from the dev runtime and is
# deleted in #808, so its dependency tree and source are dead weight, not shipped attack
# surface.

on:
  workflow_call:

permissions:
  contents: read

jobs:
  security:
    name: Security
    runs-on: bloom-arc
    steps:
      - uses: actions/checkout@v4

      - uses: pnpm/action-setup@v4
        with:
          version: 10.6.3

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
          cache-dependency-path: pnpm-lock.yaml

      # Root install + audit cover the whole workspace (apps/web and packages/*) via the single
      # root lockfile (#481).
      - name: Install web workspace dependencies
        run: pnpm install --frozen-lockfile

      - name: Web dependency audit (production deps)
        run: pnpm audit --prod --audit-level high

      - name: Web dependency audit (all deps, informational)
        run: pnpm audit --audit-level high || true