name: Docker Security Scan

on:
  push:
    branches: [main, "stable/*"]
  schedule:
    - cron: "0 6 * * 1"  # Weekly Monday 06:00 UTC

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
      - run: docker build -t turnstone:scan .
      - uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          image-ref: "turnstone:scan"
          severity: "HIGH,CRITICAL"
          exit-code: "1"
