pr-security-gates.yml

name: PR Security Gates

on:
  pull_request:
    branches: [main, develop]

permissions:
  contents: read
  security-events: write
  pull-requests: write

jobs:
  secret-scanning:
    name: Secret Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: TruffleHog
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --only-verified

  sast:
    name: SAST — Semgrep
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4

      - name: Semgrep Scan
        run: |
          semgrep ci \
            --config=p/owasp-top-ten \
            --config=p/secrets \
            --config=p/python \
            --config=p/docker \
            --sarif \
            --output=semgrep.sarif
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload Semgrep SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif

  codeql:
    name: SAST — CodeQL
    runs-on: ubuntu-latest
    strategy:
      matrix:
        language: [python, javascript]
    steps:
      - uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended

      - name: Autobuild
        uses: github/codeql-action/autobuild@v3

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3

  dependency-audit:
    name: Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Safety
        run: pip install safety

      - name: Python Safety Check
        run: |
          if [ -f requirements.txt ]; then
            safety check -r requirements.txt --full-report --output json > safety-report.json
            python3 -c "
          import json, sys
          with open('safety-report.json') as f:
              data = json.load(f)
          vulns = data.get('vulnerabilities', [])
          critical = [v for v in vulns if v.get('severity','').lower() == 'critical']
          if critical:
              print(f'FAIL: {len(critical)} critical vulnerabilities found')
              sys.exit(1)
          print(f'PASS: {len(vulns)} total vulnerabilities, 0 critical')
          "
          fi

      - name: OWASP Dependency Check
        uses: dependency-check/Dependency-Check_Action@main
        with:
          project: ${{ github.repository }}
          path: '.'
          format: 'HTML'
          args: --failOnCVSS 9

      - name: Upload OWASP Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: dependency-check-report
          path: reports/

  iac-scanning:
    name: IaC Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: tfsec
        uses: aquasecurity/tfsec-action@v1.0.3
        with:
          soft_fail: false
          format: sarif
          sarif_file: tfsec.sarif

      - name: Upload tfsec SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: tfsec.sarif

      - name: Checkov
        uses: bridgecrewio/checkov-action@master
        with:
          directory: terraform/
          framework: terraform
          output_format: sarif
          output_file_path: checkov.sarif
          soft_fail: false

      - name: Upload Checkov SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: checkov.sarif

  license-check:
    name: License Compliance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: FOSSA Scan
        uses: fossas/fossa-action@main
        with:
          api-key: ${{ secrets.FOSSA_API_KEY }}

  pr-summary:
    name: Security Summary Comment
    runs-on: ubuntu-latest
    needs: [secret-scanning, sast, dependency-audit, iac-scanning]
    if: always()
    steps:
      - uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const jobs = {
              'Secret Scanning': '${{ needs.secret-scanning.result }}',
              'SAST (Semgrep + CodeQL)': '${{ needs.sast.result }}',
              'Dependency Audit': '${{ needs.dependency-audit.result }}',
              'IaC Scanning': '${{ needs.iac-scanning.result }}'
            };
            const icon = r => r === 'success' ? '✅' : r === 'skipped' ? '⏭️' : '❌';
            const rows = Object.entries(jobs).map(([k,v]) => `| ${k} | ${icon(v)} ${v} |`).join('\n');
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## Security Gate Results\n\n| Check | Status |\n|-------|--------|\n${rows}`
            });