name: "Unit Tests: Security"

# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
on:
  push:
    branches: [main, "litellm_*"]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  security:
    uses: ./.github/workflows/_test-unit-services-base.yml
    with:
      test-path: "tests/proxy_security_tests/"
      workers: 1
      reruns: 2
      timeout-minutes: 20
      enable-redis: false
      enable-postgres: true
    secrets:
      DATABASE_URL: ${{ secrets.DATABASE_URL }}
      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}