security.yml

name: Security Audit

on:
  schedule:
    - cron: '0 0 * * 0'  # Weekly on Sunday
  workflow_dispatch:
  push:
    branches: [ main, mcp-remote ]
    paths:
      - '**/requirements*.txt'
      - '**/pyproject.toml'
      - '**/Dockerfile'
      - '**/*.py'

jobs:
  dependency-audit:
    name: Dependency Security Audit
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
    
    - name: Install audit tools
      run: |
        python -m pip install --upgrade pip
        pip install safety pip-audit bandit semgrep
    
    - name: Install project dependencies
      run: pip install -e .
    
    - name: Run safety check
      run: |
        safety check --json --output safety-report.json || true
        if [ -f safety-report.json ]; then
          echo "### Safety Report" >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
          cat safety-report.json >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
        fi
    
    - name: Run pip-audit
      run: |
        pip-audit --format json --output pip-audit-report.json || true
        if [ -f pip-audit-report.json ]; then
          echo "### Pip Audit Report" >> $GITHUB_STEP_SUMMARY
          echo '```json' >> $GITHUB_STEP_SUMMARY
          cat pip-audit-report.json >> $GITHUB_STEP_SUMMARY
          echo '```' >> $GITHUB_STEP_SUMMARY
        fi
    
    - name: Upload security reports
      uses: actions/upload-artifact@v4
      with:
        name: dependency-security-reports
        path: |
          safety-report.json
          pip-audit-report.json
      if: always()

  code-security:
    name: Code Security Analysis
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Set up Python
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
    
    - name: Run Bandit
      run: |
        pip install bandit
        bandit -r src/ -f json -o bandit-report.json || true
        echo "### Bandit Security Report" >> $GITHUB_STEP_SUMMARY
        echo '```' >> $GITHUB_STEP_SUMMARY
        bandit -r src/ -f txt || true
        echo '```' >> $GITHUB_STEP_SUMMARY
    
    - name: Run Semgrep
      uses: returntocorp/semgrep-action@v1
      with:
        config: auto
      continue-on-error: true
    
    - name: Upload code security reports
      uses: actions/upload-artifact@v4
      with:
        name: code-security-reports
        path: bandit-report.json
      if: always()

  docker-security:
    name: Docker Security Scan
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/mcp-remote'
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
      continue-on-error: true
    
    - name: Upload Trivy results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-results.sarif'
      if: always()
    
    - name: Dockerfile linting
      uses: hadolint/hadolint-action@v3.1.0
      with:
        dockerfile: Dockerfile
        format: json
        output-file: hadolint-report.json
      continue-on-error: true
    
    - name: Upload Docker security reports
      uses: actions/upload-artifact@v4
      with:
        name: docker-security-reports
        path: |
          trivy-results.sarif
          hadolint-report.json
      if: always()

  secrets-scan:
    name: Secrets Detection
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    
    - name: TruffleHog OSS
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD
        extra_args: --debug --only-verified
      continue-on-error: true
    
    - name: Gitleaks
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      continue-on-error: true