name: Security

# Ruft den zentralen Scan-Workflow in security-workflows auf
# (Semgrep SAST + Trivy filesystem scan).

on:
  push:
    branches: [main, master]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

jobs:
  scan:
    uses: JonKazama-Hellion/security-workflows/.gitea/workflows/security-scan.yml@main
    with:
      # MessageStore.cs interpoliert SQL-Strings, die plugin-lokal sicher sind;
      # Semgrep matcht das Pattern, CodeQL mit Datenflussanalyse nicht.
      semgrep-exclude-rules: 'csharp.lang.security.sqli.csharp-sqli.csharp-sqli'