name: Security Audit

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]
  schedule:
    - cron: "27 4 * * 1"

permissions:
  contents: read

jobs:
  npm-audit:
    name: npm audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      # Пока non-blocking: сообщаем о HIGH/CRITICAL, но не валим пайплайн.
      # Когда долги по зависимостям разгребём — убрать continue-on-error.
      - name: Run npm audit (high+)
        continue-on-error: true
        run: npm audit --audit-level=high