basil/.gitea/workflows/security.yml

name: Security Scanning

on:
  push:
    branches: [ main, master, develop ]
  pull_request:
    branches: [ main, master ]
  schedule:
    # Run security scans weekly on Monday at 9 AM UTC
    - cron: '0 9 * * 1'

jobs:
  dependency-audit:
    name: NPM Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Run npm audit in API package
        working-directory: packages/api
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Run npm audit in Web package
        working-directory: packages/web
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Generate audit report
        if: always()
        run: |
          echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "NPM audit has been completed for all packages." >> $GITHUB_STEP_SUMMARY
          echo "Review the logs above for any vulnerabilities." >> $GITHUB_STEP_SUMMARY

  dependency-check:
    name: Dependency License Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Check for outdated dependencies
        run: npm outdated || true

      - name: List all dependencies
        run: |
          echo "## Dependency List" >> $GITHUB_STEP_SUMMARY
          npm list --all || true

  code-scanning:
    name: Code Quality Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint with security rules
        run: npm run lint
        continue-on-error: true

      - name: Check for hardcoded secrets (basic)
        run: |
          echo "Scanning for potential secrets..."
          if grep -r -i -E "(password|secret|api[_-]?key|token|credential)" --include="*.ts" --include="*.js" --exclude-dir=node_modules --exclude-dir=dist . | grep -v "process.env" | grep -v "// "; then
            echo "⚠️ Warning: Potential hardcoded secrets found!"
            echo "Review the results above and ensure no sensitive data is committed."
          else
            echo "✅ No obvious hardcoded secrets detected."
          fi

  docker-security:
    name: Docker Image Security
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build Docker images
        run: docker-compose build

      - name: Scan Docker images for vulnerabilities
        run: |
          echo "## Docker Security Scan" >> $GITHUB_STEP_SUMMARY
          echo "Docker images have been built successfully." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Consider using tools like Trivy or Snyk for comprehensive vulnerability scanning." >> $GITHUB_STEP_SUMMARY

  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [dependency-audit, dependency-check, code-scanning]
    if: always()
    steps:
      - name: Generate security summary
        run: |
          echo "# 🔒 Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "All security scans have been completed." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## Scans Performed:" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ NPM Dependency Audit" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Dependency License Check" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Code Quality Scanning" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Review individual job logs for detailed results." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Recommended Additional Tools:" >> $GITHUB_STEP_SUMMARY
          echo "- **Snyk**: For advanced vulnerability scanning" >> $GITHUB_STEP_SUMMARY
          echo "- **Trivy**: For Docker image scanning" >> $GITHUB_STEP_SUMMARY
          echo "- **SonarQube**: For code quality and security analysis" >> $GITHUB_STEP_SUMMARY
          echo "- **Dependabot**: For automated dependency updates" >> $GITHUB_STEP_SUMMARY