---
# Trivy — scan hebdomadaire du dépôt (lockfiles : package-lock.json, go.sum,
# requirements*.txt, Gemfile.lock, ...). Lundi 06:00 + dispatch manuel.
name: trivy-repo-weekly
on:
  schedule:
    - cron: '0 6 * * 1'        # lundi 06:00 Europe/Paris (fuseau runner)
  workflow_dispatch:

concurrency:
  group: trivy-repo-weekly
  cancel-in-progress: false

jobs:
  scan-fs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Scan Trivy — lockfiles du dépôt
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          format: table
          exit-code: 1                     # échoue sur HIGH/CRITICAL
          severity: HIGH,CRITICAL
          ignore-unfixed: true
          timeout: 15m
        env:
          TRIVY_CACHE_DIR: /tmp/.trivy

      - name: Résultat
        if: failure()
        run: echo "::warning::Vulnérabilités HIGH/CRITICAL dans les dépendances du dépôt (voir logs ci-dessus)"