# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# Scheduled OSV-Scanner scanning for vulnerabilities.
# Runs on push to main and weekly schedule.
# Split from osv-scanner.yml to prevent "skipped" noise on PRs.
#
# For more examples and options, including how to ignore specific vulnerabilities,
# see https://google.github.io/osv-scanner/github-action/

name: OSV-Scanner (Scheduled)

on:
  push:
    branches: [ "main" ]  # Create baseline for Code Scanning comparison
  schedule:
    - cron: '41 21 * * 1'  # Weekly on Monday at 21:41 UTC
  workflow_dispatch:

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

jobs:
  scan-scheduled:
    permissions:
      security-events: write
      contents: read
      actions: read
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8
    with:
      scan-args: |-
        -r
        --skip-git
        ./