security-scan.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.

name: Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday at midnight
  workflow_dispatch:

# Cause-B mitigation (#77): cancel superseded runs so stacked pushes
# to the same ref don't pile up identical jobs in the queue.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  scan:
    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@0d531555f4c04f086f0af58ec34e1bb27145fdbe # main 2026-07-07 (skip dispatch without VERISIMDB_PAT)
    secrets:
      VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}