fix(ci): remove shell-injection risk in release workflows, re-enable … #6

	name: security

	on:
	pull_request:
	branches: [master, main]
	push:
	branches: [master, main]
	schedule:
	- cron: '11 6 * * 1'

	jobs:
	semgrep:
	name: semgrep
	runs-on: ubuntu-latest
	if: github.event_name != 'pull_request' \|\| github.event.pull_request.head.repo.full_name == github.repository
	container:
	image: semgrep/semgrep
	steps:
	- uses: actions/checkout@v4
	# Report ERROR-severity findings in the log without failing the build.
	# (Drop `--error` to keep semgrep from exiting non-zero on findings.)
	- run: \|
	semgrep scan --severity ERROR \
	--config p/javascript \
	--config p/typescript \
	--config p/owasp-top-ten \
	--config p/secrets

	npm-audit:
	name: npm audit
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: 20
	- name: Audit (skip when no package.json)
	run: \|
	if [ -f package.json ]; then
	(npm ci --no-audit --no-fund 2>/dev/null \|\| npm install --no-audit --no-fund)
	npm audit --audit-level=high
	else
	echo "no package.json — skipping npm audit"
	fi

	gitleaks:
	name: gitleaks
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Install gitleaks
	run: \|
	VERSION=8.21.2
	curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
	\| tar -xz -C /usr/local/bin gitleaks
	gitleaks version
	- name: Scan history
	run: gitleaks detect --source . --redact --verbose --no-banner --exit-code 1

Provide feedback