goobits-repos 2.1.0

# GitHub Actions: Security Audit Workflow
#
# This workflow runs repos audit on every push to main branch
# and fails the build if verified secrets are found.
#
# Place this file in: .github/workflows/security-audit.yml

name: Security Audit

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly on Mondays at 9 AM UTC
    - cron: '0 9 * * 1'

jobs:
  security-audit:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        # Fetch full history for comprehensive secret scanning
        fetch-depth: 0

    - name: Install Rust
      uses: actions-rs/toolchain@v1
      with:
        toolchain: stable
        override: true

    - name: Install repos
      run: |
        git clone https://github.com/goobits/repos.git
        cd repos
        cargo build --release
        sudo cp target/release/repos /usr/local/bin/
        repos --version

    - name: Run security audit
      run: |
        repos audit --install-tools --verify --json > audit-report.json
      continue-on-error: false
      # Exit code 1 if verified secrets found → fails build

    - name: Upload audit report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: security-audit-report
        path: audit-report.json

    - name: Comment on PR (if secrets found)
      if: failure() && github.event_name == 'pull_request'
      uses: actions/github-script@v7
      with:
        script: |
          const fs = require('fs');
          const report = JSON.parse(fs.readFileSync('audit-report.json', 'utf8'));

          const body = `## ⚠️ Security Audit Failed

          Verified secrets found in this PR!

          **Secrets found:** ${report.truffle.summary.verified_secrets}
          **Types:** ${Object.entries(report.truffle.secrets_by_detector).map(([k,v]) => `${v}x ${k}`).join(', ')}

          Please review and rotate these secrets immediately.`;

          github.rest.issues.createComment({
            issue_number: context.issue.number,
            owner: context.repo.owner,
            repo: context.repo.repo,
            body: body
          });