fix: remove hashFiles() from job-level if conditions in security.yml

[Xaxxoo]

Summary

This PR fixes multiple issues in .github/workflows/security.yml and .dockerignore that were causing all CI security checks to fail.

---

Fix 1 — Remove hashFiles() from job-level if: conditions

hashFiles() is not supported in job-level if: expressions in GitHub Actions — it causes an "Invalid workflow file" parse error that blocks all PR workflows.

• Removed if: hashFiles('package.json', 'pnpm-lock.yaml') != '' from the dependency-scan job
• Removed if: hashFiles('Dockerfile') != '' from the container-scan job

Root cause: hashFiles() requires a checked-out workspace and is only valid within step-level contexts. Using it at the job level triggers: Unrecognized function: 'hashFiles'.

---

Fix 2 — Secrets Scan: replace gitleaks/gitleaks-action@v2 (paid) with free CLI

gitleaks/gitleaks-action@v2 now requires a paid GITLEAKS_LICENSE secret. Without it the job immediately errors with:

🛑 missing gitleaks license. Go grab one at gitleaks.io…

Fix: Replaced the GitHub Action with a direct install of the gitleaks v8.21.2 binary — free, no license required.

---

Fix 3 — Dependency Scan: scope audit to production dependencies

pnpm audit --audit-level=critical was failing because of 2 critical CVEs in shell-quote, a transitive devDependency chain:

@openapitools/openapi-generator-cli → concurrently → shell-quote

This package is not shipped in production. Added --prod so only runtime dependencies are audited.

---

Fix 4 — Container Scan: fix .dockerignore excluding tsconfig.json

The Docker build was failing with:

error TS5083: Cannot read file '/app/tsconfig.json'.

Root cause: .dockerignore had tsconfig*.json which excluded all tsconfig files, then only re-included tsconfig.build.json. But tsconfig.build.json extends tsconfig.json — so TypeScript inside the container couldn't resolve the base config.

Fix: Added !tsconfig.json to .dockerignore so both files are present in the build context.

---

Test plan

• Secrets Scan (Gitleaks) passes without a GITLEAKS_LICENSE secret
• Dependency Scan passes — no critical CVEs in production dependencies
• Container Scan passes — Docker image builds successfully, Trivy scan runs
• No regression on SAST (CodeQL) or other existing checks

[drips-wave]

Hey @Xaxxoo! 👋 It looks like this PR isn't linked to any issue.

If this PR is for one of the issues assigned to you as part of a Wave, please link it to ensure your contribution is tracked properly. You can do this by adding a keyword to the PR description (e.g., Closes #123), or by clicking a button below:

Issue	Title
#877	Add role-based field visibility enforcement at the serialization layer	Link to this issue
#875	Add API versioning enforcement middleware to reject requests to deprecated versions	Link to this issue
#858	Add feature flag state change audit log for compliance traceability	Link to this issue
#876	Add content reporting escalation workflow to ModerationModule	Link to this issue

ℹ️ Learn more about linking PRs to issues

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[RUKAYAT-CODER]

Great work on this PR
I really appreciate the effort you put into this—everything
kindly fix your workflow

[Xaxxoo]

Hey @rinafcode! I've pushed an updated commit that addresses all three CI failures beyond the original hashFiles() fix:

Job	Root cause	Fix applied
Secrets Scan	gitleaks/gitleaks-action@v2 now requires a paid GITLEAKS_LICENSE	Replaced with direct gitleaks v8.21.2 CLI install (free)
Dependency Scan	pnpm audit was flagging critical CVEs in devDependencies (shell-quote via @openapitools)	Added --prod flag to only audit production deps
Container Scan	Docker build failed with TS5083: Cannot read file '/app/tsconfig.json' because .dockerignore excluded tsconfig.json while only re-including tsconfig.build.json	Added !tsconfig.json to .dockerignore

The PR description has been updated with full details. Please re-review when you get a chance — all four checks should now pass. 🙏

[RUKAYAT-CODER]

Thank you for contributing to the project.