name: Code Quality

permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

# Superseded PR pushes cancel their older run. Every main push gets its own
# group (run_id), so no main commit's run is ever cancelled or dropped as pending.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  security:
    name: bandit (high severity)
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Set up Python 3.10
        uses: actions/setup-python@v7
        with:
          python-version: "3.10"

      - name: Install bandit
        run: pip install bandit[toml]

      # Medium findings are reported without failing until they are triaged.
      # High severity is a hard gate.
      - name: Security report (medium and above, informational)
        run: bandit -r . -ll -q --exclude ./tests,./reference,./venv,./tools/vendor/node_modules --exit-zero
      - name: Security scan (high severity gate)
        run: bandit -r . -lll -q --exclude ./tests,./reference,./venv,./tools/vendor/node_modules