security-auditor.yml

name: security-auditor

# Runs the Tier A deterministic scanner against the test fixtures on both Linux and
# Windows. The test runners assert each fixture's verdict and exit non-zero on mismatch,
# so the job gates on the scanner's exit code (the same gate you would use in your own CI).

on:
  push:
    paths:
      - 'security-auditor/**'
      - '.github/workflows/security-auditor.yml'
  pull_request:
    paths:
      - 'security-auditor/**'
      - '.github/workflows/security-auditor.yml'

permissions:
  contents: read

jobs:
  tier-a-linux:
    name: Tier A self-test (Linux / bash)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run scanner self-test
        run: bash security-auditor/tests/run-tests.sh

  tier-a-windows:
    name: Tier A self-test (Windows PowerShell 5.1)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run scanner self-test
        shell: powershell
        run: .\security-auditor\tests\run-tests.ps1