name: Security

# GitHub Actions is public mirror validation only.
# Primary registry release security evidence must be produced on Russian build-runner.

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read

jobs:
  cargo-audit:
    name: Cargo audit
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: adk-rust
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        uses: taiki-e/install-action@cargo-audit

      - name: cargo audit
        run: cargo audit

  cargo-deny:
    name: Cargo deny
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: cargo deny
        run: cargo deny check advisories licenses sources --config ../deny.toml
        working-directory: adk-rust

  secret-pattern-check:
    name: Secret pattern check
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Scan for obvious secret patterns
        run: python3 scripts/public_secret_pattern_check.py

  dependency-review:
    name: Dependency review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Dependency Review
        uses: actions/dependency-review-action@v4