security.yml

name: Security

on:
  pull_request:
  merge_group:
  push:
    branches:
      - main
  schedule:
    - cron: "0 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  dependency-audit:
    name: pnpm audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.7.0

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Audit production dependencies
        run: pnpm audit --prod --audit-level high

      - name: Audit dev dependencies
        run: pnpm audit --dev --audit-level critical

      - name: Verify package registry signatures
        run: pnpm audit signatures

  dependency-review:
    name: dependency review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Review dependency changes
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high
          fail-on-scopes: runtime
          license-check: true
          allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC
          allow-dependencies-licenses: >-
            pkg:npm/jackspeak@3.4.3,
            pkg:npm/lodash.includes@4.3.0,
            pkg:npm/lodash.isinteger@4.0.4,
            pkg:npm/lodash.isplainobject@4.0.6,
            pkg:npm/lodash.once@4.1.1,
            pkg:npm/lru-cache@11.5.1,
            pkg:npm/minipass@7.1.3,
            pkg:npm/package-json-from-dist@1.0.1,
            pkg:npm/path-scurry@1.11.1

  codeql:
    name: codeql
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          languages: javascript-typescript
          queries: +security-extended,security-and-quality

      - name: Analyze
        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0

  secrets:
    name: gitleaks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Scan for secrets
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # Required for GitHub organization repos using Gitleaks Action.
          # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

  workflow-lint:
    name: workflow lint
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Run actionlint
        run: docker run --rm -v "$PWD":/repo -w /repo rhysd/actionlint:1.7.12 .github/workflows/*.yml

      - name: Install zizmor
        run: python3 -m pip install --user zizmor==1.26.1

      - name: Run zizmor
        run: ~/.local/bin/zizmor --min-severity=medium --format sarif .github/workflows > zizmor.sarif
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload zizmor SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: zizmor.sarif
          category: zizmor

  semgrep:
    name: semgrep
    if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install Semgrep
        run: python3 -m pip install --user semgrep==1.168.0

      - name: Semgrep scan
        run: ~/.local/bin/semgrep scan --config=auto --sarif --output=semgrep.sarif --error .

      - name: Upload Semgrep SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: semgrep.sarif
          category: semgrep

  trivy-fs:
    name: trivy filesystem
    if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Trivy filesystem scan
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: fs
          scan-ref: .
          vuln-type: os,library
          severity: CRITICAL,HIGH
          exit-code: "1"
          format: sarif
          output: trivy.sarif

      - name: Upload Trivy SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: trivy.sarif
          category: trivy

  scorecard:
    name: openssf scorecard
    if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Run Scorecard
        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
        with:
          results_format: sarif
          results_file: scorecard.sarif
          publish_results: true

      - name: Upload Scorecard SARIF
        if: always()
        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
        with:
          sarif_file: scorecard.sarif
          category: scorecard

  sbom:
    name: cyclonedx sbom
    if: github.event_name != 'pull_request' && github.event_name != 'merge_group'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
        with:
          version: 11.7.0

      - name: Setup Node.js
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Generate CycloneDX SBOM
        run: pnpm dlx @cyclonedx/cyclonedx-npm@5.0.0 --ignore-npm-errors --output-file bom.json

      - name: Upload SBOM
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: cyclonedx-sbom
          path: bom.json
          if-no-files-found: error