feat: add scheduled security checks for Composer and NPM

Author: konradmichalik

README.md

@@ -111,6 +111,17 @@ Includes:
 - `cache/cache-feature-warmup.yaml`
 - `cache/cache-prod-warmup.yaml`
 
+### Security
+
+Run security checks using `audit` tools.
+
+Includes:
+- `security/security-composer-check-scheduled.yaml`
+- `security/security-npm-check-scheduled.yaml`
+
+> [!NOTE]
+> Needs to be scheduled in GitLab-CI.
+
 ## ⭐ License
 
 This project is licensed under [GNU General Public License 3.0 (or later)](LICENSE).

security/security-composer-check-scheduled.yaml

@@ -0,0 +1,25 @@
+# Purpose:
+#   Analyze job for scanning for security vulnerabilities running within a gitlab schedule
+#
+# Dependency:
+#   Deployer task "security:check:composer"
+#
+security:composer:check:scheduled:
+  stage: analyse
+  extends:
+    - .base-schedule
+  dependencies: [ ]
+  cache:
+    key: security-$CI_JOB_NAME-$CI_COMMIT_REF_NAME
+    paths:
+      - vendor/xima/xima-deployer-tools/deployer/security/
+  variables:
+    GIT_STRATEGY: fetch
+  script:
+    - !reference [.check-deployment-dependencies, script]
+    - vendor/bin/dep security:check:composer local --notify $DEPLOYER_CONFIG_ADDITIONAL_OPTION
+  rules:
+    - if: $CI_JOB_NAME == $SCHEDULE_TASK_NAME
+      when: always
+    - when: never
+  resource_group: $CI_COMMIT_REF_NAME

security/security-npm-check-scheduled.yaml

@@ -0,0 +1,25 @@
+# Purpose:
+#   Analyze job for scanning for security vulnerabilities running within a gitlab schedule
+#
+# Dependency:
+#   Deployer task "security:check:npm"
+#
+security:npm:check:scheduled:
+  stage: analyse
+  extends:
+    - .base-schedule
+  dependencies: [ ]
+  cache:
+    key: security-$CI_JOB_NAME-$CI_COMMIT_REF_NAME
+    paths:
+      - vendor/xima/xima-deployer-tools/deployer/security/
+  variables:
+    GIT_STRATEGY: fetch
+  script:
+    - !reference [.check-deployment-dependencies, script]
+    - vendor/bin/dep security:check:npm local --notify $DEPLOYER_CONFIG_ADDITIONAL_OPTION
+  rules:
+    - if: $CI_JOB_NAME == $SCHEDULE_TASK_NAME
+      when: always
+    - when: never
+  resource_group: $CI_COMMIT_REF_NAME