Add modular security checks

modules/security.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+set -euo pipefail
+
+echo "============================"
+echo " Davidson CI - Security"
+echo "============================"
+
+# -------------------------
+# Composer audit
+# -------------------------
+
+echo
+echo "→ Composer security audit"
+
+if [ -f composer.lock ]; then
+    composer audit
+else
+    echo "No composer.lock - skipping Composer audit"
+fi
+
+# -------------------------
+# npm audit
+# -------------------------
+
+echo
+echo "→ npm security audit"
+
+if [ -f package-lock.json ]; then
+    npm audit --audit-level=high
+else
+    echo "No package-lock.json - skipping npm audit"
+fi
+
+# -------------------------
+# Semgrep
+# -------------------------
+
+echo
+echo "→ Semgrep"
+
+semgrep scan \
+    --config=p/security-audit \
+    --error \
+    --exclude=node_modules \
+    --exclude=vendor \
+    .
+
+# -------------------------
+# Trivy vulnerability scan
+# -------------------------
+
+echo
+echo "→ Trivy vulnerabilities"
+
+trivy fs \
+    --scanners vuln \
+    --severity HIGH,CRITICAL \
+    --exit-code 1 \
+    --no-progress \
+    .
+
+# -------------------------
+# Trivy secret scan
+# -------------------------
+
+echo
+echo "→ Trivy secrets"
+
+trivy fs \
+    --scanners secret \
+    --exit-code 1 \
+    --no-progress \
+    .
+
+echo
+echo "Security module completed successfully"