security.yml

name: Security

on:
  schedule:
    - cron: '0 2 * * 1'  # Every Monday at 2 AM
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

jobs:
  security:
    name: Security Scan
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
        
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install safety bandit
        
    - name: Run safety check
      run: |
        safety check --json --output safety-report.json || true
        
    - name: Run bandit security scan
      run: |
        bandit -r agent/ -f json -o bandit-report.json || true
        
    - name: Upload security reports
      uses: actions/upload-artifact@v3
      with:
        name: security-reports
        path: |
          safety-report.json
          bandit-report.json
        retention-days: 30

  dependency-update:
    name: Dependency Update Check
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      
    - name: Set up Python 3.9
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'
        
    - name: Install pip-tools
      run: |
        python -m pip install --upgrade pip
        pip install pip-tools
        
    - name: Check for outdated dependencies
      run: |
        pip list --outdated --format=json > outdated-deps.json
        
    - name: Create issue for outdated dependencies
      uses: actions/github-script@v6
      with:
        script: |
          const fs = require('fs');
          const outdated = JSON.parse(fs.readFileSync('outdated-deps.json', 'utf8'));
          
          if (outdated.length > 0) {
            const body = `## Outdated Dependencies Found
            
            The following dependencies have newer versions available:
            
            ${outdated.map(dep => `- **${dep.name}**: ${dep.version} → ${dep.latest_version}`).join('\n')}
            
            Please review and update these dependencies when appropriate.
            
            ---
            *This issue was automatically generated by GitHub Actions.*`;
            
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: '🔍 Outdated Dependencies Detected',
              body: body,
              labels: ['dependencies', 'automated']
            });
          }