security-scan.yml

name: 'Security Code Scanner'

# Minimal permissions - jobs override as needed
permissions:
  contents: read

on:
  workflow_call:
    inputs:
      repo:
        description: 'Repository that requested the scan'
        required: false
        type: string
        default: ${{ github.repository }}
      languages-config:
        description: |
          Optional: JSON array of language configurations to override/supplement repo config file.
          Auto-detects languages and loads repo-specific config from packages/codeql-action/repo-configs/${repo}.cjs.
          Workflow input takes precedence over file config for same languages.
          Example:
          [
            {
              "language": "java",
              "build_mode": "manual",
              "build_command": "./gradlew build",
              "version": "21",
              "distribution": "temurin"
            },
            {
              "language": "javascript",
              "build_mode": "none"
            }
          ]
        required: false
        type: string
        default: ''
      scanner-ref:
        description: 'The git ref of the scanner to use'
        required: true
        type: string
      paths-ignored:
        description: 'Multi-line list of paths to ignore during scan (one path per line, supports glob patterns)'
        required: false
        type: string
        default: ''
      rules-excluded:
        description: 'Comma delimited IDs of rules to exclude'
        required: false
        type: string
        default: ''
    secrets:
      project-metrics-token:
        description: 'Analytics token to log failed builds'
        required: false
      slack-webhook:
        description: 'Slack webhook for notifications'
        required: false

env:
  MONOREPO_PATH: .security-scanner

jobs:
  # Detect languages and create matrix
  setup:
    name: Setup
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.detect-languages.outputs.matrix }}
    steps:
      - name: Checkout monorepo (for local actions)
        uses: actions/checkout@v6
        with:
          repository: MetaMask/action-security-code-scanner
          ref: ${{ inputs.scanner-ref }}
          path: ${{ env.MONOREPO_PATH }}

      - name: Checkout target repository
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.repo }}
          path: ${{ inputs.repo }}

      - name: Detect languages and create matrix
        id: detect-languages
        uses: ./.security-scanner/packages/language-detector
        with:
          repo: ${{ inputs.repo }}
          languages_config: ${{ inputs.languages-config }}

  # Run CodeQL analysis for each detected language
  codeql-analysis:
    name: CodeQL analysis
    needs: setup
    if: ${{ fromJSON(needs.setup.outputs.matrix).include[0] != null }}
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout monorepo (for local actions)
        uses: actions/checkout@v6
        with:
          repository: MetaMask/action-security-code-scanner
          ref: ${{ inputs.scanner-ref }}
          path: ${{ env.MONOREPO_PATH }}

      - name: Checkout target repository
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.repo }}
          path: ${{ inputs.repo }}

      - name: Run CodeQL Analysis
        uses: ./.security-scanner/packages/codeql-action
        with:
          repo: ${{ inputs.repo }}
          language: ${{ matrix.language }}
          paths_ignored: ${{ inputs.paths-ignored }}
          rules_excluded: ${{ inputs.rules-excluded }}
          build_mode: ${{ matrix.build_mode }}
          build_command: ${{ matrix.build_command }}
          version: ${{ matrix.version }}
          distribution: ${{ matrix.distribution }}

  # Run Semgrep analysis once for all languages
  semgrep-analysis:
    name: Semgrep analysis
    needs: setup
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout monorepo (for local actions)
        uses: actions/checkout@v6
        with:
          repository: MetaMask/action-security-code-scanner
          ref: ${{ inputs.scanner-ref }}
          path: ${{ env.MONOREPO_PATH }}

      - name: Checkout target repository
        uses: actions/checkout@v6
        with:
          repository: ${{ inputs.repo }}
          path: ${{ inputs.repo }}

      - name: Run Semgrep Analysis
        uses: ./.security-scanner/packages/semgrep-action
        with:
          paths_ignored: ${{ inputs.paths-ignored }}

  # Collect results and handle notifications
  finalize:
    name: Finalize scans and notify
    needs: [codeql-analysis, semgrep-analysis]
    if: always()
    runs-on: ubuntu-latest
    env:
      SLACK_WEBHOOK: ${{ secrets.slack-webhook }}
      PROJECT_METRICS_TOKEN: ${{ secrets.project-metrics-token }}
      REPO: ${{ inputs.repo }}
    steps:
      - name: Determine overall scan result
        id: scan-result
        env:
          CODEQL_RESULT: ${{ needs.codeql-analysis.result }}
          SEMGREP_RESULT: ${{ needs.semgrep-analysis.result }}
        run: |
          if [[ "$CODEQL_RESULT" == "failure" || "$SEMGREP_RESULT" == "failure" ]]; then
            echo "result=failure" >> "$GITHUB_OUTPUT"
            echo "SCAN_RESULT=failure" >> "$GITHUB_ENV"
          else
            echo "result=success" >> "$GITHUB_OUTPUT"
            echo "SCAN_RESULT=success" >> "$GITHUB_ENV"
          fi

      - name: Post to Slack channel
        if: ${{ steps.scan-result.outputs.result == 'failure' && env.SLACK_WEBHOOK != '' }}
        uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844
        with:
          payload: |
            {
              "text": "Security scan failed for ${{ env.REPO }} - Run: https://github.com/${{ env.REPO }}/actions/runs/${{ github.run_id }}",
              "channel": "#security-notifications"
            }
        env:
          SLACK_WEBHOOK_URL: ${{ env.SLACK_WEBHOOK }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

      - name: Log metrics
        if: ${{ env.PROJECT_METRICS_TOKEN != '' }}
        run: |
          # TODO: Implement metrics logging
          echo "Logging scan result: $SCAN_RESULT for repo: ${{ env.REPO }}"

      - name: Fail if security issues found
        if: ${{ steps.scan-result.outputs.result == 'failure' }}
        run: exit 1