security.yml

name: Security Scan

on:
  push:
    branches: [ main ]
  schedule:
    # Run security scan weekly
    - cron: '0 2 * * 0'

jobs:
  # Job 1: Basic Security Scan
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python 3.11
      uses: actions/setup-python@v4
      with:
        python-version: "3.11"

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements-ci.txt
        pip install safety

    - name: Run Safety check
      run: |
        safety check --json --output safety-report.json || echo "Safety check completed with issues"
      continue-on-error: true

    - name: Run Bandit security scan
      run: |
        bandit -r app/ src/ examples/ scripts/ -f json -o bandit-report.json || echo "Bandit scan completed with issues"
      continue-on-error: true

    - name: Upload Safety report
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: safety-report
        path: safety-report.json

    - name: Upload Bandit report
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: bandit-security-report
        path: bandit-report.json

    - name: Run Semgrep security scan
      run: |
        pip install semgrep
        semgrep --config=auto --json --output=semgrep-report.json app/ src/ || echo "Semgrep scan completed with findings"
      continue-on-error: true

    - name: Upload Semgrep report
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: semgrep-report
        path: semgrep-report.json