security.yml

name: Security

on:
  push:
    branches: [main]
    paths-ignore:
      - '**.md'
      - '.github/workflows/ci.yml'
      - '.github/workflows/release.yml'
  pull_request:
    branches: [main]
    paths-ignore:
      - '**.md'
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday

# Cancel in-progress runs when a new run is triggered
concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  # ============================================================================
  # Rust Security Audit
  # ============================================================================
  cargo-audit:
    name: Cargo Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run audit
        run: |
          cargo audit --json > audit-results.json 2>&1
          echo "Audit completed"

      - name: Upload audit results
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: cargo-audit-results
          path: audit-results.json

  cargo-deny:
    name: Cargo Deny
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-deny
        run: cargo install cargo-deny

      - name: Check advisories
        run: cargo deny check advisories

      - name: Check licenses
        run: cargo deny check licenses

      - name: Check bans
        run: cargo deny check bans

  # ============================================================================
  # Dependency Review (PRs only)
  # ============================================================================
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@v4

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: critical
          deny-licenses: GPL-3.0, AGPL-3.0

  # ============================================================================
  # Trivy Vulnerability Scanner
  # ============================================================================
  trivy:
    name: Trivy Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: 'trivy-results.sarif'
        if: always()

  # ============================================================================
  # Secret Scanning
  # ============================================================================
  secrets:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: TruffleHog scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified

      # Note: Gitleaks removed - requires paid license as of 2025
      # See: https://github.com/gitleaks/gitleaks-action#-announcement

  # ============================================================================
  # SAST with Semgrep
  # ============================================================================
  semgrep:
    name: Semgrep SAST
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep
        run: |
          semgrep ci --sarif --output=semgrep-results.sarif || true
          # Create empty sarif if semgrep failed
          if [ ! -f semgrep-results.sarif ]; then
            echo '{"version":"2.1.0","$schema":"https://json.schemastore.org/sarif-2.1.0.json","runs":[]}' > semgrep-results.sarif
          fi
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload Semgrep results
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: semgrep-results.sarif
        if: always()
        continue-on-error: true

  # ============================================================================
  # Quality Gate — fails if any critical security check failed
  # ============================================================================
  security-gate:
    name: Security Gate
    runs-on: ubuntu-latest
    if: always()
    needs: [cargo-audit, cargo-deny, secrets, trivy]
    steps:
      - name: Check results
        run: |
          echo "cargo-audit: ${{ needs.cargo-audit.result }}"
          echo "cargo-deny:  ${{ needs.cargo-deny.result }}"
          echo "secrets:     ${{ needs.secrets.result }}"
          echo "trivy:       ${{ needs.trivy.result }}"
          if [[ "${{ needs.cargo-audit.result }}" == "failure" ]] || \
             [[ "${{ needs.cargo-deny.result }}" == "failure" ]] || \
             [[ "${{ needs.secrets.result }}" == "failure" ]]; then
            echo "::error::Security gate failed — critical check(s) did not pass"
            exit 1
          fi