name: Pipelock Security Scan

on:
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Pipelock Scan
        uses: luckyPipewrench/pipelock@v2
        with:
          scan-diff: 'true'
          fail-on-findings: 'true'
          test-vectors: 'false'
          exclude-paths: |
            .env.example
            compose.example.yml
            compose.example.ai.yml
            config/locales/views/reports/
            docs/hosting/ai.md
            app/models/provider/binance.rb
