# CodeQL and Checkov scans for ci-infra
#
name: "Security Scan"

permissions: read-all

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 12 * * 6'  # Runs every Saturday at 12:00 PM

jobs:
  Analyze-Python:
    name: Analyze Python code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize CodeQL
        uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
        with:
          languages: python
      - name: Run CodeQL Analysis
        uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3.29.0
        continue-on-error: true

  Analyze-IaC:
    name: Analyze Infra as Code
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.10'
      - name: Install Checkov
        run: pip install checkov
      - name: Run Checkov
        run: checkov --quiet -d .
