dependency-vulnerability-scanning.yml

name: Dependency Vulnerability Scanning

on:
  push:
    branches: [main, develop]
    paths:
      - 'package.json'
      - 'package-lock.json'
      - 'apps/*/package.json'
      - 'apps/*/package-lock.json'
      - 'Cargo.toml'
      - 'Cargo.lock'
      - 'contracts/*/Cargo.toml'
  pull_request:
    branches: [main, develop]
  schedule:
    - cron: '0 3 * * *'  # Daily at 3 AM UTC

jobs:
  npm-audit:
    name: NPM Audit - Frontend & Backend
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm install

      - name: Run npm audit
        id: npm-audit
        run: |
          echo "🔍 Running npm audit..."
          
          # Run audit and capture output
          npm audit --audit-level=moderate > npm-audit-report.txt 2>&1 || true
          
          # Check for high/critical vulnerabilities
          if npm audit --audit-level=high > /dev/null 2>&1; then
            echo "audit_status=pass" >> $GITHUB_OUTPUT
            echo "✅ No high/critical vulnerabilities found"
          else
            echo "audit_status=fail" >> $GITHUB_OUTPUT
            echo "❌ High/critical vulnerabilities detected"
            cat npm-audit-report.txt
            exit 1
          fi

      - name: Generate npm audit JSON report
        run: npm audit --json > npm-audit-report.json 2>&1 || true

      - name: Upload npm audit report
        uses: actions/upload-artifact@v4
        with:
          name: npm-audit-report
          path: npm-audit-report.*
          retention-days: 30

  cargo-audit:
    name: Cargo Deny - Rust Contracts
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-deny
        run: cargo install cargo-deny --locked

      - name: Run cargo deny (advisories + licenses + bans)
        id: cargo-audit
        run: |
          echo "🔍 Running cargo deny check..."
          cargo deny check 2>&1 | tee cargo-deny-report.txt
          if [ ${PIPESTATUS[0]} -ne 0 ]; then
            echo "audit_status=fail" >> $GITHUB_OUTPUT
            echo "❌ cargo deny found issues"
            exit 1
          else
            echo "audit_status=pass" >> $GITHUB_OUTPUT
            echo "✅ No issues found in Rust dependencies"
          fi

      - name: Upload cargo deny report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cargo-deny-report
          path: cargo-deny-report.txt
          retention-days: 30

  snyk-scan:
    name: Snyk Security Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'schedule'

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Snyk scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --json-file-output=snyk-report.json
        continue-on-error: true

      - name: Upload Snyk report
        uses: actions/upload-artifact@v4
        with:
          name: snyk-report
          path: snyk-report.json
          retention-days: 30
        continue-on-error: true

  dependabot-check:
    name: Dependabot Status Check
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
      - name: Check Dependabot PR
        run: |
          if [[ "${{ github.actor }}" == "dependabot[bot]" ]]; then
            echo "✅ Dependabot PR detected"
            echo "This PR updates dependencies automatically"
          fi

  create-security-report:
    name: Create Security Report
    runs-on: ubuntu-latest
    needs: [npm-audit, cargo-audit]
    if: always()

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Download all reports
        uses: actions/download-artifact@v4
        with:
          path: security-reports/

      - name: Generate consolidated report
        run: |
          mkdir -p final-reports
          
          cat > final-reports/security-summary.md << 'EOF'
          # Security Vulnerability Report
          
          Generated: $(date)
          
          ## Summary
          
          | Tool | Status | Details |
          |------|--------|---------|
          | npm audit | ${{ needs.npm-audit.result }} | Frontend & Backend dependencies |
          | cargo audit | ${{ needs.cargo-audit.result }} | Rust smart contracts |
          | Snyk | Pending | Third-party vulnerability database |
          
          ## Recommendations
          
          1. **High Priority**: Address all high and critical vulnerabilities immediately
          2. **Medium Priority**: Plan updates for moderate vulnerabilities in next sprint
          3. **Low Priority**: Monitor low-severity issues and update when convenient
          
          ## Next Steps
          
          - Review detailed reports in artifacts
          - Create issues for vulnerabilities that require code changes
          - Update dependencies using `npm update` or `cargo update`
          - Re-run scans after updates to verify fixes
          
          EOF
          
          cat final-reports/security-summary.md

      - name: Upload final report
        uses: actions/upload-artifact@v4
        with:
          name: security-report
          path: final-reports/
          retention-days: 90

  fail-on-critical:
    name: Fail Build on Critical Vulnerabilities
    runs-on: ubuntu-latest
    needs: [npm-audit, cargo-audit]
    if: always()

    steps:
      - name: Check for critical vulnerabilities
        run: |
          if [ "${{ needs.npm-audit.result }}" = "failure" ] || [ "${{ needs.cargo-audit.result }}" = "failure" ]; then
            echo "❌ Critical or high-severity vulnerabilities detected"
            echo "Build failed due to security vulnerabilities"
            exit 1
          else
            echo "✅ No critical vulnerabilities detected"
          fi

  auto-update-dependencies:
    name: Auto-Update Dependencies (Scheduled)
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'

    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - name: Update npm dependencies
        run: |
          echo "📦 Updating npm dependencies..."
          npm update --save
          npm audit fix --audit-level=moderate || true

      - name: Set up Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Update Cargo dependencies
        run: |
          echo "📦 Updating Cargo dependencies..."
          cargo update

      - name: Create pull request
        uses: peter-evans/create-pull-request@v5
        with:
          commit-message: 'chore(deps): automated dependency updates'
          title: 'chore(deps): automated dependency updates'
          body: |
            ## Automated Dependency Updates
            
            This PR contains automated updates to dependencies.
            
            ### Changes
            - Updated npm packages (frontend & backend)
            - Updated Cargo packages (Rust contracts)
            
            ### Testing
            - [ ] Run full test suite
            - [ ] Verify no breaking changes
            - [ ] Check performance impact
            
            Please review and merge if all checks pass.
          branch: 'chore/auto-update-dependencies'
          delete-branch: true
          labels: 'dependencies, automated'
        continue-on-error: true

  notify-vulnerabilities:
    name: Notify on Vulnerabilities
    runs-on: ubuntu-latest
    needs: [npm-audit, cargo-audit]
    if: failure()

    steps:
      - name: Create security issue
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: '🔒 Security: Vulnerabilities Detected in Dependencies',
              body: `Dependency vulnerability scan detected security issues.\n\n- npm audit: ${{ needs.npm-audit.result }}\n- cargo audit: ${{ needs.cargo-audit.result }}\n\nRun: ${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}\n\nPlease review and address vulnerabilities immediately.`,
              labels: ['security', 'dependencies', 'urgent']
            });

      - name: Comment on related PRs
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '⚠️ **Security Alert**: Dependency vulnerabilities detected. Please review the security scan results before merging.'
            });