security-pipeline.yml

# Umbrella reusable workflow: the full security pipeline (ported from fil-one).
# One `uses:` line in a consumer repo runs every enabled scanner as parallel jobs;
# each scanner is also individually callable (sec-*.yml) for repos that want à la carte.
#
# Nested workflows resolve from one reviewed immutable graph commit. Consumers
# select this umbrella with one full release commit SHA.
#
# Conventions carried from fil-one:
# - SARIF publication is an explicit input and requires matching caller authority.
# - Scanners are advisory by default; flip per-scanner `blocking` inputs to gate.
# - Repo config files (.semgrep.yml, .gitleaks.toml, .trivyignore,
#   slither.config.json) are auto-detected and skipped when absent.
name: Security Pipeline (reusable)

on:
  workflow_call:
    inputs:
      # ── Scanner toggles ──────────────────────────────
      enable-semgrep:
        type: boolean
        required: false
        default: true
      enable-actions-security:
        description: Analyze GitHub Actions definitions with offline zizmor audits.
        type: boolean
        required: false
        default: true
      actions-security-blocking:
        description: Fail when Zizmor produces workflow-definition findings.
        type: boolean
        required: false
        default: false
      enable-codeql:
        description: Requires GHAS on the calling repo.
        type: boolean
        required: false
        default: false
      enable-dependencies:
        type: boolean
        required: false
        default: true
      enable-secrets:
        type: boolean
        required: false
        default: true
      secrets-blocking:
        description: Fail when Gitleaks reports findings.
        type: boolean
        required: false
        default: true
      enable-iac:
        type: boolean
        required: false
        default: true
      enable-licenses:
        type: boolean
        required: false
        default: true
      enable-dependency-review:
        description: PR events only (auto-skipped otherwise).
        type: boolean
        required: false
        default: true
      enable-sbom:
        description: Runs on push/schedule/dispatch (auto-skipped on PRs).
        type: boolean
        required: false
        default: true
      enable-scorecard:
        description: Runs on push/schedule/dispatch (auto-skipped on PRs).
        type: boolean
        required: false
        default: false
      enable-slither:
        description: For Solidity/Foundry repos.
        type: boolean
        required: false
        default: false
      # ── Shared configuration ─────────────────────────
      skip-dirs:
        description: Comma-separated dirs Trivy scans should skip.
        type: string
        required: false
        default: node_modules
      publish-sarif:
        description: Publish supported SARIF evidence to GitHub Code Security.
        type: boolean
        required: false
        default: false
      # ── Per-scanner configuration ────────────────────
      semgrep-blocking:
        description: Fail when custom Semgrep rules produce findings.
        type: boolean
        required: false
        default: false
      codeql-languages:
        description: 'JSON array, e.g. ["javascript-typescript","go"].'
        type: string
        required: false
        default: '["javascript-typescript"]'
      dependency-review-fail-on-severity:
        type: string
        required: false
        default: high
      dependency-blocking:
        description: Fail when dependency findings match the configured severity.
        type: boolean
        required: false
        default: false
      dependency-severity:
        description: Trivy severities included in dependency findings and gates.
        type: string
        required: false
        default: CRITICAL,HIGH,MEDIUM
      iac-blocking:
        description: Fail when IaC findings match the configured severity.
        type: boolean
        required: false
        default: false
      iac-severity:
        description: Trivy severities included in IaC findings and gates.
        type: string
        required: false
        default: CRITICAL,HIGH,MEDIUM
      license-blocking:
        description: Fail when license findings match the configured severity.
        type: boolean
        required: false
        default: false
      license-severity:
        description: Trivy severities included in license findings and gates.
        type: string
        required: false
        default: CRITICAL,HIGH
      deny-licenses:
        type: string
        required: false
        default: GPL-3.0, AGPL-3.0
      slither-target:
        type: string
        required: false
        default: "."
      slither-args:
        type: string
        required: false
        default: ""
      solc-version:
        type: string
        required: false
        default: 0.8.13
      slither-fail-on:
        description: "Slither finding threshold: none | low | medium | high | all | config."
        type: string
        required: false
        default: none
jobs:
  actions-security:
    if: inputs.enable-actions-security
    permissions:
      contents: read
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-actions.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      blocking: ${{ inputs.actions-security-blocking }}

  semgrep:
    if: inputs.enable-semgrep
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-semgrep.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      blocking: ${{ inputs.semgrep-blocking }}

  codeql:
    if: inputs.enable-codeql
    permissions:
      contents: read
      security-events: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-codeql.yml@578d2e6d23695fae7bba58a13a80f7c3326cb97b
    with:
      languages: ${{ inputs.codeql-languages }}

  dependencies:
    if: inputs.enable-dependencies
    permissions:
      actions: read
      contents: read
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependencies.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      skip-dirs: ${{ inputs.skip-dirs }}
      blocking: ${{ inputs.dependency-blocking }}
      severity: ${{ inputs.dependency-severity }}

  publish-dependency-sarif:
    name: Publish Dependency SARIF
    if: always() && inputs.enable-dependencies && inputs.publish-sarif
    needs: dependencies
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Download Trivy dependency results
        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
        with:
          name: trivy-deps-results
          path: trivy-deps-results

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: trivy-deps-results/trivy-deps.sarif
          category: trivy-dependencies

  secrets-scan:
    if: inputs.enable-secrets
    permissions:
      contents: read
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-secrets.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      blocking: ${{ inputs.secrets-blocking }}

  iac:
    if: inputs.enable-iac
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-iac.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      skip-dirs: ${{ inputs.skip-dirs }}
      blocking: ${{ inputs.iac-blocking }}
      severity: ${{ inputs.iac-severity }}

  licenses:
    if: inputs.enable-licenses
    permissions:
      contents: read
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-licenses.yml@952f6ad35aafc052b4bc938cef90e45ca17ced7d
    with:
      skip-dirs: ${{ inputs.skip-dirs }}
      blocking: ${{ inputs.license-blocking }}
      severity: ${{ inputs.license-severity }}

  dependency-review:
    if: inputs.enable-dependency-review && github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-dependency-review.yml@578d2e6d23695fae7bba58a13a80f7c3326cb97b
    with:
      fail-on-severity: ${{ inputs.dependency-review-fail-on-severity }}
      deny-licenses: ${{ inputs.deny-licenses }}

  sbom:
    if: inputs.enable-sbom && github.event_name != 'pull_request'
    permissions:
      contents: read
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-sbom.yml@578d2e6d23695fae7bba58a13a80f7c3326cb97b

  scorecard:
    if: inputs.enable-scorecard && github.event_name != 'pull_request'
    permissions:
      contents: read
      security-events: write
      id-token: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-scorecard.yml@578d2e6d23695fae7bba58a13a80f7c3326cb97b

  slither:
    if: inputs.enable-slither
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: filecoin-project/ff-sec-actions/.github/workflows/sec-slither.yml@578d2e6d23695fae7bba58a13a80f7c3326cb97b
    with:
      target: ${{ inputs.slither-target }}
      slither-args: ${{ inputs.slither-args }}
      solc-version: ${{ inputs.solc-version }}
      fail-on: ${{ inputs.slither-fail-on }}