security.yml

name: Security Checks

on:
  push:
    branches: [main, develop]
  pull_request:
  schedule:
    - cron: '0 0 * * 0'  # Weekly vulnerability scan

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  npm-audit:
    name: NPM Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: npm audit --audit-level=moderate
        continue-on-error: true

      - name: Check for fixable vulnerabilities
        run: npm audit fix --dry-run
        continue-on-error: true

  snyk-scan:
    name: Snyk Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run Snyk scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        continue-on-error: true

  container-scan:
    name: Container Image Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          tags: budget-api:scan
          load: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: budget-api:scan
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
          category: 'trivy'

  secret-scan:
    name: Secret & Credential Detection
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run gitleaks scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  eslint:
    name: ESLint Code Quality
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run ESLint
        run: npx eslint src --max-warnings 0 --format json --output-file eslint-report.json || true
        continue-on-error: true

      - name: Comment on PR with ESLint results
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const report = JSON.parse(fs.readFileSync('eslint-report.json', 'utf8'));
            const issues = report.filter(f => f.messages.length > 0);
            if (issues.length > 0) {
              let comment = '## ESLint Issues\n\n';
              issues.forEach(file => {
                comment += `### ${file.filePath}\n`;
                file.messages.forEach(msg => {
                  comment += `- Line ${msg.line}: ${msg.message} (${msg.severity})\n`;
                });
              });
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: comment
              });
            }

  docker-build:
    name: Docker Build Test
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile
          tags: budget-api:test
          cache-from: type=gha
          cache-to: type=gha,mode=max

  dependency-check:
    name: OWASP Dependency-Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: 'budget-automation'
          path: '.'
          format: 'JSON'
          args: >
            --enable-retired

      - name: Upload Dependency-Check results
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: 'dependency-check-report.sarif'
          category: 'dependency-check'

  license-check:
    name: License Compliance
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Check licenses
        run: npx license-checker --onlyunknown
        continue-on-error: true

  summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [npm-audit, snyk-scan, container-scan, secret-scan, eslint, docker-build]
    if: always()
    steps:
      - name: Check security status
        run: |
          echo "Security checks completed!"
          echo "Review the results above for any issues."