Homelab MCP Server

name: Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
  schedule:
    - cron: "0 2 * * 1" # Weekly Monday 2am UTC

jobs:
  dependency-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: "20"
          cache: "pnpm"

      - name: Setup pnpm
        uses: pnpm/action-setup@v4
        with:
          version: 9

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run pnpm audit
        run: |
          set +e
          pnpm audit --audit-level=moderate
          EXIT_CODE=$?
          if [ $EXIT_CODE -eq 1 ]; then
            echo "::warning::Vulnerabilities found - check audit output"
            exit 0
          elif [ $EXIT_CODE -ne 0 ]; then
            echo "::error::pnpm audit failed with exit code $EXIT_CODE"
            exit $EXIT_CODE
          fi

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.33.1
        with:
          scan-type: "fs"
          scan-ref: "."
          format: "sarif"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: "trivy-results.sarif"