security-scan.yml

name: PR Audit

on:
  push:
    branches: [ main, master ]
  pull_request_target:
    types: [ labeled ]
  schedule:
    - cron: '0 9 * * 1'  # Weekly on Monday at 9 AM UTC

permissions:
  contents: read
  pull-requests: write
  security-events: write

jobs:
  jfrog-audit:
    if: github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'safe to test')
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Setup JDK 8
        uses: actions/setup-java@v4
        with:
          java-version: '8'
          distribution: 'temurin'
          cache: maven

      - name: Set up JFrog CLI
        uses: jfrog/setup-jfrog-cli@v4
        env:
          JF_URL: ${{ secrets.JF_URL }}
          JF_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_ACCESS_TOKEN }}

      - name: Run JFrog Audit
        run: jf audit

      - name: Run Tests
        run: mvn clean test -B