name: Security & Audit Pipeline

on:
  push:
    branches: [ "main", "master", "develop" ]
  pull_request:
    branches: [ "main", "master" ]

jobs:
  audit-and-security:
    name: Security Scan & Dependency Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Run Gitleaks to detect secrets
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Backend Security Audit
        run: |
          cd backend
          npm audit --audit-level=high

      - name: Frontend Security Audit
        run: |
          cd frontend/application
          npm audit --audit-level=high

      - name: Backend Build & Type Check
        run: |
          cd backend
          npm ci
          npm run build

      - name: Frontend Build & Type Check
        run: |
          cd frontend/application
          npm ci
          npm run build