name: Security Audit

on:
  push:
    branches: [master]
  schedule:
    - cron: '0 8 * * 1'  # Montags 8 Uhr

jobs:
  audit-backend:
    name: 🔒 Backend Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: npm audit
        working-directory: backend
        run: npm audit --omit=dev || true
        continue-on-error: true

  audit-frontend:
    name: 🔒 Frontend Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: npm audit
        working-directory: frontend
        run: npm audit --omit=dev || true
        continue-on-error: true