Advanced Security Scanning #25

	name: Advanced Security Scanning

	on:
	push:
	branches: [ main, dev ]
	pull_request:
	branches: [ main ]
	schedule:
	- cron: '0 0 * * 0' # Weekly on Sundays

	permissions:
	contents: read
	security-events: write

	jobs:
	semgrep:
	name: Semgrep Security Scan
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1
	with:
	config: >-
	p/security-audit
	p/secrets
	p/owasp-top-ten
	p/python
	p/rust

	dependency-review:
	name: Dependency Review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v4
	- name: Dependency Review
	uses: actions/dependency-review-action@v4
	with:
	fail-on-severity: moderate

	# Note: Basic security scans (cargo-audit, pip-audit, bandit) are already
	# included in the unified-ci.yml workflow to avoid duplication.
	# This workflow focuses on additional specialized security tools.

Provide feedback