security.yml

# Copyright 2026 ResQ Software
# SPDX-License-Identifier: Apache-2.0
#
# Thin caller for the org-wide reusable security-scan workflow in
# resq-software/.github.

name: security

on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: '17 6 * * 1'
  workflow_dispatch:

permissions:
  # `actions: read` is required by the reusable workflow's CodeQL + SARIF-upload
  # jobs (they declare it for github/codeql-action telemetry). An explicit
  # permissions block sets every unlisted scope to `none`, so without this the
  # nested jobs request more than the caller grants and the run is rejected at
  # creation (startup_failure). Read-only; grants no write capability.
  actions: read
  contents: read
  security-events: write
  pull-requests: read

jobs:
  scan:
    # Skip on Dependabot PRs: a cross-repo reusable workflow called with `secrets: inherit`
    # startup-fails for Dependabot's restricted context, which blocks Dependabot's own security
    # PRs. Dependabot already vetted the bump; push/schedule still scan the default branch.
    if: ${{ github.actor != 'dependabot[bot]' }}
    uses: resq-software/.github/.github/workflows/security-scan.yml@73b9edb8f4f28a99f70ee22eb5e2dd2bf7807c84 # main
    with:
      # No `languages:` on purpose — CodeQL on this repo is GitHub's code
      # scanning DEFAULT SETUP, not this workflow. While both existed the
      # reusable's CodeQL job ran, then had its upload refused:
      #   "CodeQL analyses from advanced configurations cannot be processed
      #    when the default setup is enabled"  (job status: configuration error)
      # so every run threw its own results away. Omitting this input leaves it
      # at the reusable's '[]' default, whose `if:` gate skips that job.
      # Coverage is unchanged: default setup runs the `extended` query suite,
      # which is broader than the default suite this workflow used.
      enable-semgrep: true
    # Pass only the secret the reusable workflow actually needs for the
    # opt-ins enabled above. Avoids the blanket `secrets: inherit`
    # exposure (zizmor: secrets-inherit).
    secrets:
      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}