composer-security:
    stage: security
    image: $CI_REGISTRY/ldc-web/projets/ldc-web-images-docker/ldcweb-qa:php7.3-1.0
    script:
        - local-php-security-checker --format=json --path=./composer.lock > composer-security-checker-report.json
    artifacts:
        when: on_failure
        expose_as: 'composer-security-checker'
        paths:
          - composer-security-checker-report.json
    allow_failure: true
    rules:
        - if: $CI_PIPELINE_SOURCE == "merge_request_event"
        - if: $CI_COMMIT_BRANCH == "trunk" || $CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "main"
        - if: $CI_COMMIT_TAG != null