security.yml

name: Security Audits

on:
  schedule:
    - cron: '30 8 * * 5'

permissions:
  contents: read

jobs:
  bundle_audit:
    name: Bundle audit
    runs-on: ubuntu-latest
    timeout-minutes: 15

    concurrency:
      group: "${{ github.workflow }} / bundle_audit @ ${{ github.ref }}"
      cancel-in-progress: true

    steps:
    - uses: actions/checkout@v4
    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: '3.3.6'
        bundler-cache: false
    - name: Bundle audit
      run: |
        gem install bundler-audit
        bundle audit check --update

  bundle_leak:
    name: Bundle leak
    runs-on: ubuntu-latest
    timeout-minutes: 15

    concurrency:
      group: "${{ github.workflow }} / bundle_leak @ ${{ github.ref }}"
      cancel-in-progress: true

    steps:
    - uses: actions/checkout@v4
    - name: Set up Ruby
      uses: ruby/setup-ruby@v1
      with:
        ruby-version: '3.3.6'
        bundler-cache: false
    - name: Bundle leak
      run: |
        gem install bundler-leak
        bundle leak check --update

  pnpm_audit:
    name: pnpm audit
    runs-on: ubuntu-latest
    timeout-minutes: 15

    concurrency:
      group: "${{ github.workflow }} / pnpm_audit @ ${{ github.ref }}"
      cancel-in-progress: true

    steps:
    - uses: actions/checkout@v4
    - uses: pnpm/action-setup@v4
    - name: Set up Node
      uses: actions/setup-node@v4
      with:
        node-version: '20'
    - name: pnpm audit
      run: pnpm audit