From 57524ebb7de5bc9f5bd3eedd900f2ade4e45a25c Mon Sep 17 00:00:00 2001
From: Amix <A831ARD0@users.noreply.github.com>
Date: Mon, 3 Aug 2026 07:17:00 -0600
Subject: [PATCH] ci: add Brakeman and bundle-audit security scan job (#15169)

---
 .github/workflows/run_foss_spec.yml | 18 ++++++++++++++++++
 Gemfile.lock                        |  3 ++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/run_foss_spec.yml b/.github/workflows/run_foss_spec.yml
index c2a626388..1cd0d5a36 100644
--- a/.github/workflows/run_foss_spec.yml
+++ b/.github/workflows/run_foss_spec.yml
@@ -21,6 +21,24 @@ jobs:
       - name: Run Rubocop
         run: bundle exec rubocop --parallel
 
+  security-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+      - name: Run Brakeman
+        # Non-blocking for now: Brakeman surfaces 35 pre-existing findings
+        # (13 High confidence) that need security-team triage before this
+        # can be turned into a hard gate.
+        continue-on-error: true
+        run: bundle exec brakeman -q --no-pager
+      - name: Run bundle-audit
+        run: |
+          bundle exec bundle-audit update
+          bundle exec bundle-audit check
+
   lint-frontend:
     runs-on: ubuntu-latest
     steps:
diff --git a/Gemfile.lock b/Gemfile.lock
index 46a1c0449..33bfcf378 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -174,7 +174,8 @@ GEM
     bindex (0.8.1)
     bootsnap (1.16.0)
       msgpack (~> 1.2)
-    brakeman (5.4.1)
+    brakeman (8.0.5)
+      racc
     browser (5.3.1)
     builder (3.3.0)
     bullet (8.0.7)