security-scan.yml

name: Security Scan

on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * 1"

permissions:
  contents: read

jobs:
  security-scan:
    name: Security Scan with OpenRouter
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1

      - name: Setup mise
        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          experimental: true

      - name: Setup Takumi Guard npm registry
        uses: flatt-security/setup-takumi-guard-npm@9a5d797c2085b6326d3a2985c08e3a114b9b88c1 # v1

      - name: Install dependencies
        run: pnpm install

      - name: Generate repomix XML files
        run: pnpm exec tsx scripts/generate-repomix-xml.ts

      - name: Run security scan
        env:
          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
          SECURITY_SCAN_MODEL: ${{ secrets.SECURITY_SCAN_MODEL }}
          SECURITY_SCAN_PROMPT: ${{ secrets.SECURITY_SCAN_PROMPT }}
          RESEND_API_KEY: ${{ secrets.RESEND_API_KEY }}
          RESEND_FROM_EMAIL: ${{ secrets.RESEND_FROM_EMAIL }}
          SECURITY_SCAN_RECIPIENT: ${{ secrets.SECURITY_SCAN_RECIPIENT }}
        run: pnpm exec tsx scripts/security-scan-xml.ts