name: Security Scan

on:
  schedule:
    - cron: '0 2 * * 1'  # Every Monday at 2 AM
  workflow_dispatch:
    inputs:
      severity:
        description: 'Severity levels to scan'
        required: false
        type: choice
        default: 'HIGH,CRITICAL'
        options:
          - 'CRITICAL'
          - 'HIGH,CRITICAL'
          - 'MEDIUM,HIGH,CRITICAL'
          - 'LOW,MEDIUM,HIGH,CRITICAL'
      scan-path:
        description: 'Path to scan (default: entire repo)'
        required: false
        type: string
        default: '.'
      exit-on-error:
        description: 'Fail if vulnerabilities found'
        required: false
        type: boolean
        default: false
  pull_request:
    paths:
      - 'main/**'
      - 'lib/**'
      - 'platformio.ini'
      - '.github/workflows/**'

jobs:
  security-scan:
    name: Scan for vulnerabilities
    uses: ./.github/workflows/task-security-scan.yml
    with:
      scan-type: 'fs'
      severity: ${{ inputs.severity || 'HIGH,CRITICAL' }}
      exit-code: ${{ inputs.exit-on-error && '1' || '0' }}
      upload-to-security-tab: true
      scan-path: ${{ inputs.scan-path || '.' }}