secrets-and-sast-vendored.yml

# ============================================================================
# Secrets & SAST Scanning — VENDORED from eSolia/devkit
# ============================================================================
# Source: https://github.com/eSolia/devkit/blob/main/.github/workflows/secrets-and-sast.yml
# Vendored: 2026-04-29
#
# Why vendored: hibana is public + cross-org from eSolia/devkit (private).
# GitHub blocks public consumers from calling private reusable workflows,
# and also blocks cross-org calls to private reusable workflows. So we keep
# a local copy here, matching the pattern in RickCogley/pub-cogley,
# RickCogley/tedasuke, and eSolia/marquis.
#
# Drift policy: re-sync periodically by diffing against the upstream file. No
# automated sync — hibana is intentionally not a devkit sync consumer.
#
# Triggered by: .github/workflows/security.yml (the wrapper).
#
# Scanners:
#   - Trivy filesystem vuln/secret/license scan
#   - Gitleaks secret scan
#   - Semgrep SAST (multi-language)
#   - Syft SBOM (optional — Syft auto-detects ecosystems)
#   - collect-scan-results bridge → scan-results artifact
#   - security-summary
# ============================================================================

name: Secrets and SAST

on:
  workflow_call:
    inputs:
      source-paths:
        description: "Space-separated paths for Semgrep to scan"
        required: false
        type: string
        default: "."
      semgrep-config:
        description: "Semgrep rule configurations (space-separated)"
        required: false
        type: string
        default: "p/owasp-top-ten p/secrets p/security-audit"
      run-sbom:
        description: "Run Syft SBOM generation (Syft auto-detects ecosystems)"
        required: false
        type: boolean
        default: true
      upload-sarif:
        description: "Upload SARIF to GitHub Security tab (requires Code Security enabled, paid for private repos)"
        required: false
        type: boolean
        default: false
    secrets:
      SEMGREP_APP_TOKEN:
        description: "Optional Semgrep App token for enhanced rules"
        required: false

# Cancel in-flight scans when a new commit arrives on the same PR ref.
# Push/release events keep running so evidence always completes for
# merged commits and tagged releases.
concurrency:
  group: secrets-and-sast-${{ github.repository }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

# NOTE: Per-job permissions blocks are intentionally omitted.
# GitHub Actions does not support per-job permissions in reusable workflows
# called via workflow_call — they cause startup_failure. The caller's
# permissions (org default: read) apply to all jobs.

jobs:
  # ==========================================================================
  # Trivy — filesystem vuln/secret/license scan
  # ==========================================================================
  trivy:
    name: Trivy Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Compute weekly cache key
        id: week
        run: echo "key=$(date -u +%Y-%V)" >> "$GITHUB_OUTPUT"

      - name: Cache Trivy vulnerability database
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.cache/trivy
          key: trivy-db-v1-${{ steps.week.outputs.key }}
          restore-keys: |
            trivy-db-v1-

      - name: Prepare reports directory
        run: mkdir -p reports

      - name: Trivy filesystem scan — vulnerabilities
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scanners: vuln
          format: json
          output: reports/trivy-vulns.json
          exit-code: "0"
        continue-on-error: true

      - name: Trivy filesystem scan — secrets
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scanners: secret
          format: json
          output: reports/trivy-secrets.json
          exit-code: "0"
          skip-setup-trivy: true
        continue-on-error: true

      - name: Trivy filesystem scan — licenses
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scanners: license
          format: json
          output: reports/trivy-licenses.json
          exit-code: "0"
          skip-setup-trivy: true
        continue-on-error: true

      - name: Trivy filesystem scan — table summary
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          format: table
          exit-code: "0"
          skip-setup-trivy: true
        continue-on-error: true

      - name: Upload Trivy reports
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: trivy-reports
          path: reports/trivy-*.json
          retention-days: 30
          if-no-files-found: ignore

      - name: Trivy Summary
        if: always()
        run: |
          echo "## Trivy Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ -f "reports/trivy-vulns.json" ]; then
            CRITICAL=$(cat reports/trivy-vulns.json | jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' 2>/dev/null || echo "0")
            HIGH=$(cat reports/trivy-vulns.json | jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH")] | length' 2>/dev/null || echo "0")
            echo "### Vulnerabilities" >> $GITHUB_STEP_SUMMARY
            echo "- Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
            echo "- High: $HIGH" >> $GITHUB_STEP_SUMMARY
          fi

          if [ -f "reports/trivy-secrets.json" ]; then
            SECRETS=$(cat reports/trivy-secrets.json | jq '[.Results[]?.Secrets[]?] | length' 2>/dev/null || echo "0")
            echo "### Secrets" >> $GITHUB_STEP_SUMMARY
            echo "- Found: $SECRETS" >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "See artifacts for full details." >> $GITHUB_STEP_SUMMARY

  # ==========================================================================
  # Gitleaks secret scan
  # ==========================================================================
  secret-scan:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Install Gitleaks
        run: |
          GITLEAKS_VERSION="8.21.2"
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | tar -xz
          chmod +x gitleaks
          sudo mv gitleaks /usr/local/bin/

      - name: Run Gitleaks
        run: |
          mkdir -p reports
          gitleaks detect --source . --report-path reports/gitleaks.json --report-format json || true
          gitleaks detect --source . --report-path reports/gitleaks.sarif --report-format sarif || true
        continue-on-error: true

      - name: Upload Gitleaks report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: gitleaks-report
          path: reports/gitleaks.*
          retention-days: 30
          if-no-files-found: ignore

      - name: Gitleaks Summary
        if: always()
        run: |
          echo "## Secret Scanning Results" >> $GITHUB_STEP_SUMMARY
          if [ -f "reports/gitleaks.json" ]; then
            FINDINGS=$(cat reports/gitleaks.json | jq 'length' 2>/dev/null || echo "0")
            if [ "$FINDINGS" = "0" ] || [ "$FINDINGS" = "null" ]; then
              echo "No secrets detected" >> $GITHUB_STEP_SUMMARY
            else
              echo "**$FINDINGS** potential secrets found" >> $GITHUB_STEP_SUMMARY
            fi
          else
            echo "No secrets detected" >> $GITHUB_STEP_SUMMARY
          fi

  # ==========================================================================
  # Semgrep SAST
  # ==========================================================================
  semgrep:
    name: Semgrep SAST
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Run Semgrep
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
          SEMGREP_CONFIG: ${{ inputs.semgrep-config }}
          SCAN_PATHS: ${{ inputs.source-paths }}
        run: |
          mkdir -p reports

          CONFIG_ARGS=""
          for config in $SEMGREP_CONFIG; do
            CONFIG_ARGS="$CONFIG_ARGS --config $config"
          done

          # Single scan pass — SARIF is derived below via jq to avoid
          # scanning the codebase twice.
          semgrep scan \
            $CONFIG_ARGS \
            --json \
            --output reports/semgrep.json \
            $SCAN_PATHS \
            || true
        continue-on-error: true

      - name: Derive SARIF from Semgrep JSON
        run: |
          if [ ! -f reports/semgrep.json ]; then
            echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"semgrep"}},"results":[]}]}' > reports/semgrep.sarif
            exit 0
          fi
          jq '{
            "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json",
            version: "2.1.0",
            runs: [{
              tool: {driver: {name: "semgrep", informationUri: "https://semgrep.dev"}},
              results: [(.results // [])[] | {
                ruleId: .check_id,
                level: (
                  if (.extra.severity // "INFO") == "ERROR" then "error"
                  elif (.extra.severity // "INFO") == "WARNING" then "warning"
                  else "note" end
                ),
                message: {text: (.extra.message // .check_id)},
                locations: [{
                  physicalLocation: {
                    artifactLocation: {uri: .path},
                    region: {startLine: (.start.line // 1)}
                  }
                }]
              }]
            }]
          }' reports/semgrep.json > reports/semgrep.sarif

      - name: Upload Semgrep reports
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: semgrep-report
          path: reports/semgrep.*
          retention-days: 30

      - name: Upload to GitHub Security
        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
        if: inputs.upload-sarif
        with:
          sarif_file: reports/semgrep.sarif

      - name: Semgrep Summary
        if: always()
        run: |
          echo "## Semgrep SAST Results" >> $GITHUB_STEP_SUMMARY
          if [ -f reports/semgrep.json ]; then
            FINDINGS=$(cat reports/semgrep.json | python3 -c "import json,sys; d=json.load(sys.stdin); print(len(d.get('results', [])))" 2>/dev/null || echo "0")
            echo "Found **$FINDINGS** potential issues" >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo "See uploaded artifact for details." >> $GITHUB_STEP_SUMMARY
          else
            echo "No report generated" >> $GITHUB_STEP_SUMMARY
          fi

  # ==========================================================================
  # SBOM Generation (Syft) — optional; Syft auto-detects ecosystems
  # ==========================================================================
  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    # SBOM runs only on non-PR events — the release-time SBOM is what
    # ships with evidence; per-PR SBOM is noise.
    if: inputs.run-sbom && github.event_name != 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Install Syft
        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0

      - name: Generate CycloneDX SBOM
        run: |
          mkdir -p reports
          syft dir:. -o cyclonedx-json="reports/sbom.cdx.json" --quiet
          echo "SBOM size: $(wc -c < reports/sbom.cdx.json) bytes"
          echo "Packages: $(jq '.components | length' reports/sbom.cdx.json)"

      - name: Upload SBOM
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: sbom
          path: reports/sbom.cdx.json
          retention-days: 90

  # ==========================================================================
  # Collect Scan Results — produces the artifact attest-and-ship.yml consumes
  # ==========================================================================
  collect-scan-results:
    name: Collect Scan Results
    runs-on: ubuntu-latest
    needs: [trivy, secret-scan, semgrep, sbom]
    if: always()
    steps:
      - name: Download all scan artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: ./all-scans

      - name: Aggregate into scan-results
        run: |
          mkdir -p scan-results

          cp all-scans/gitleaks-report/gitleaks.sarif scan-results/ 2>/dev/null || true
          cp all-scans/semgrep-report/semgrep.sarif   scan-results/ 2>/dev/null || true

          cp all-scans/gitleaks-report/gitleaks.json scan-results/ 2>/dev/null || true
          cp all-scans/semgrep-report/semgrep.json   scan-results/ 2>/dev/null || true
          cp all-scans/trivy-reports/trivy-vulns.json    scan-results/ 2>/dev/null || true
          cp all-scans/trivy-reports/trivy-secrets.json  scan-results/ 2>/dev/null || true
          cp all-scans/trivy-reports/trivy-licenses.json scan-results/ 2>/dev/null || true

          cp all-scans/sbom/sbom.cdx.json scan-results/ 2>/dev/null || true

          TRIVY_JSON="all-scans/trivy-reports/trivy-vulns.json"
          if [[ -f "$TRIVY_JSON" ]]; then
            CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' "$TRIVY_JSON" 2>/dev/null || echo 0)
            HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH")] | length' "$TRIVY_JSON" 2>/dev/null || echo 0)
          else
            CRITICAL=0
            HIGH=0
          fi

          GITLEAKS_JSON="all-scans/gitleaks-report/gitleaks.json"
          if [[ -f "$GITLEAKS_JSON" ]]; then
            SECRETS=$(jq 'length' "$GITLEAKS_JSON" 2>/dev/null || echo 0)
          else
            SECRETS=0
          fi

          SCANNERS='["trivy", "gitleaks", "semgrep"]'
          if [[ -f "all-scans/sbom/sbom.cdx.json" ]]; then
            SCANNERS='["trivy", "gitleaks", "semgrep", "syft"]'
          fi

          jq -n \
            --argjson c "${CRITICAL:-0}" \
            --argjson h "${HIGH:-0}" \
            --argjson s "${SECRETS:-0}" \
            --argjson scanners "$SCANNERS" \
            '{
              sarif_critical: $c,
              sarif_high: $h,
              secrets_found: $s,
              scan_status: "completed",
              scanners: $scanners
            }' > scan-results/summary.json

          echo "=== scan-results contents ==="
          ls -la scan-results/
          echo ""
          echo "=== summary.json ==="
          cat scan-results/summary.json

      - name: Upload unified scan-results artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: scan-results
          path: scan-results/
          retention-days: 90

  # ==========================================================================
  # Security Summary
  # ==========================================================================
  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [trivy, secret-scan, semgrep, sbom, collect-scan-results]
    if: always()
    steps:
      - name: Generate Summary
        env:
          TRIVY_RESULT: ${{ needs.trivy.result }}
          SECRET_RESULT: ${{ needs.secret-scan.result }}
          SEMGREP_RESULT: ${{ needs.semgrep.result }}
          SBOM_RESULT: ${{ needs.sbom.result }}
          COLLECT_RESULT: ${{ needs.collect-scan-results.result }}
        run: |
          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Trivy (vulns/secrets/licenses) | $TRIVY_RESULT |" >> $GITHUB_STEP_SUMMARY
          echo "| Gitleaks Secrets | $SECRET_RESULT |" >> $GITHUB_STEP_SUMMARY
          echo "| Semgrep SAST | $SEMGREP_RESULT |" >> $GITHUB_STEP_SUMMARY
          echo "| Syft SBOM | $SBOM_RESULT |" >> $GITHUB_STEP_SUMMARY
          echo "| Scan Results Aggregation | $COLLECT_RESULT |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "See individual job artifacts for detailed reports." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "---" >> $GITHUB_STEP_SUMMARY
          echo "*Workflow vendored from [eSolia/devkit](https://github.com/eSolia/devkit) — see .github/workflows/secrets-and-sast-vendored.yml header for sync policy.*" >> $GITHUB_STEP_SUMMARY