name: Comprehensive Security Code Review
on:
  workflow_dispatch:  # Manual trigger for thorough reviews
  schedule:
    - cron: '0 2 * * 1'  # Weekly on Mondays at 2 AM

jobs:
  security-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Fraim Comprehensive Security Review
        uses: fraim-dev/fraim-action@423d9d6b3c80923557887930d80eec4ca22a5c24
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          workflow: code
          workflow_args: |
            {
              "confidence": 6,
              "chunk-size": 400,
              "max-concurrent-chunks": 3,
              "max-concurrent-triagers": 2
            }
          debug: true

name: Language-Specific Security Analysis
on:
  pull_request:
    branches: [main]

jobs:
  python-security:
    if: contains(github.event.pull_request.changed_files, '.py') || contains(github.event.pull_request.changed_files, 'requirements.txt')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Python Security Analysis
        uses: fraim-dev/fraim-action@423d9d6b3c80923557887930d80eec4ca22a5c24
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          workflow: code
          workflow_args: |
            {
              "globs": ["*.py", "requirements.txt"],
              "confidence": 7
            }

  javascript-security:
    if: contains(github.event.pull_request.changed_files, '.js') || contains(github.event.pull_request.changed_files, '.ts') || contains(github.event.pull_request.changed_files, 'package.json')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run JavaScript/TypeScript Security Analysis
        uses: fraim-dev/fraim-action@423d9d6b3c80923557887930d80eec4ca22a5c24
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          workflow: code
          workflow_args: |
            {
              "globs": ["*.js", "*.ts", "package.json"],
              "confidence": 7
            }

  java-security:
    if: contains(github.event.pull_request.changed_files, '.java') || contains(github.event.pull_request.changed_files, 'pom.xml') || contains(github.event.pull_request.changed_files, 'build.gradle')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Java Security Analysis
        uses: fraim-dev/fraim-action@423d9d6b3c80923557887930d80eec4ca22a5c24
        with:
          anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
          workflow: code
          workflow_args: |
            {
              "globs": ["*.java", "pom.xml", "build.gradle"],
              "confidence": 7
            }