From 20b9ce41b67028ef855880e2bd98dcac22aee80e Mon Sep 17 00:00:00 2001
From: Pauljd <pauljd720@gmail.com>
Date: Tue, 8 Sep 2026 17:19:06 +0100
Subject: [PATCH] Add modular security checks

---
 modules/security.sh | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)
 create mode 100755 modules/security.sh

diff --git a/modules/security.sh b/modules/security.sh
new file mode 100755
index 0000000..8569bda
--- /dev/null
+++ b/modules/security.sh
@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "============================"
+echo " Davidson CI - Security"
+echo "============================"
+
+# -------------------------
+# Composer audit
+# -------------------------
+
+echo
+echo "→ Composer security audit"
+
+if [ -f composer.lock ]; then
+    composer audit
+else
+    echo "No composer.lock - skipping Composer audit"
+fi
+
+# -------------------------
+# npm audit
+# -------------------------
+
+echo
+echo "→ npm security audit"
+
+if [ -f package-lock.json ]; then
+    npm audit --audit-level=high
+else
+    echo "No package-lock.json - skipping npm audit"
+fi
+
+# -------------------------
+# Semgrep
+# -------------------------
+
+echo
+echo "→ Semgrep"
+
+semgrep scan \
+    --config=p/security-audit \
+    --error \
+    --exclude=node_modules \
+    --exclude=vendor \
+    .
+
+# -------------------------
+# Trivy vulnerability scan
+# -------------------------
+
+echo
+echo "→ Trivy vulnerabilities"
+
+trivy fs \
+    --scanners vuln \
+    --severity HIGH,CRITICAL \
+    --exit-code 1 \
+    --no-progress \
+    .
+
+# -------------------------
+# Trivy secret scan
+# -------------------------
+
+echo
+echo "→ Trivy secrets"
+
+trivy fs \
+    --scanners secret \
+    --exit-code 1 \
+    --no-progress \
+    .
+
+echo
+echo "Security module completed successfully"