name: Codeant Security Scan

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:

jobs:
  codeant-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '20'

      - name: Install CodeAnt CLI
        run: npm install -g @codeant/cli

      - name: Run CodeAnt Scan
        env:
          # IMPORTANT: Use this EXACT variable name
          CODEANT_API_TOKEN: ${{ secrets.CODEANT_API_KEY }}
        run: |
          # We use the universal 'scan' command which covers 
          # Secrets, SAST, and Quality in one go.
          codeant scan --all --fail-on-severity HIGH