composer-security:
    stage: security
    image: composer:2.10
    before_script:
        - composer config gitlab-token.lab.s-web.fr $CI_DEPLOY_USER $CI_DEPLOY_PASSWORD
    script:
        - composer audit --locked --format=json > composer-security-checker-report.json || true
    artifacts:
        when: on_failure
        expose_as: 'composer-security-checker'
        paths:
          - composer-security-checker-report.json
    allow_failure: true
    rules:
        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
        - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
        - if: $CI_COMMIT_TAG != null