name: Security Scan

on:
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
  workflow_dispatch:      # Manual trigger
  push:
    branches: [main, master]
    paths:
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'deny.toml'
      - '.github/workflows/security.yml'

env:
  CARGO_TERM_COLOR: always

jobs:
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - uses: Swatinem/rust-cache@v2

      - name: Install security tools
        uses: taiki-e/install-action@v2
        with:
          tool: cargo-audit,cargo-deny,cargo-outdated

      - name: Run cargo audit
        run: cargo audit

      - name: Run cargo deny
        run: cargo deny check

      - name: Check for outdated dependencies
        run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"