From 401e15151f1a3de6544ee872b6eb691aec0babbd Mon Sep 17 00:00:00 2001
From: Pauljd <pauljd720@gmail.com>
Date: Tue, 8 Sep 2026 16:10:03 +0100
Subject: [PATCH] Add security scanning to Davidson CI

---
 .gitea/workflows/ci.yml | 49 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 05b13e0..eafb7a4 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -129,3 +129,52 @@ jobs:
 
       - name: Complete
         run: echo "Davidson CI completed successfully"
+       
+           # -------------------------
+      # Security
+      # -------------------------
+
+      - name: Composer security audit
+        run: |
+          if [ -f composer.lock ]; then
+            echo "Running Composer security audit..."
+            composer audit
+          else
+            echo "No composer.lock - skipping Composer audit"
+          fi
+
+      - name: npm security audit
+        run: |
+          if [ -f package-lock.json ]; then
+            echo "Running npm security audit..."
+            npm audit --audit-level=high
+          else
+            echo "No package-lock.json - skipping npm audit"
+          fi
+
+      - name: Semgrep security scan
+        run: |
+          echo "Running Semgrep..."
+          semgrep scan \
+            --config=p/security-audit \
+            --error \
+            --exclude=node_modules \
+            --exclude=vendor \
+            .
+
+      - name: Trivy vulnerability scan
+        run: |
+          echo "Running Trivy vulnerability scan..."
+          trivy fs \
+            --scanners vuln \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            .
+
+      - name: Trivy secret scan
+        run: |
+          echo "Running Trivy secret scan..."
+          trivy fs \
+            --scanners secret \
+            --exit-code 1 \
+            .