security.yml

name: Security

on:
  schedule:
    # Run security scans daily at 2 AM UTC
    - cron: "0 2 * * *"
  pull_request:
    types: [opened, edited, synchronize, reopened]
    branches: [main]
  workflow_dispatch:

permissions:
  actions: read
  contents: read
  security-events: write

env:
  GO_VERSION: "1.26"
  REGISTRY: ghcr.io

jobs:
  # CodeQL Analysis
  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: ["go"]
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Build for CodeQL
        run: |
          go build -v ./...

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{matrix.language}}"

  # Dependency vulnerability scanning
  dependency-scan:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest

      - name: Run govulncheck
        run: |
          govulncheck -json ./... > govulncheck-results.json || true

      - name: Upload govulncheck results
        uses: actions/upload-artifact@v7
        with:
          name: govulncheck-results
          path: govulncheck-results.json

      - name: Check for high severity vulnerabilities
        run: |
          if govulncheck ./... | grep -i "high\|critical"; then
            echo "High or critical vulnerabilities found!"
            exit 1
          fi

  # Container image security scanning
  container-scan:
    name: Container Security Scan
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4

      - name: Generate lowercase image name
        id: image
        env:
          REPOSITORY: ${{ github.repository }}
        run: |
          IMAGE_NAME=$(echo "$REPOSITORY" | tr '[:upper:]' '[:lower:]')
          echo "name=${IMAGE_NAME}" >> $GITHUB_OUTPUT

      - name: Build image for scanning
        uses: docker/build-push-action@v7
        with:
          context: .
          load: true
          tags: security-scan:latest
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Run Grype vulnerability scanner
        uses: anchore/scan-action@v7
        id: grype-scan
        with:
          image: "security-scan:latest"
          fail-build: "high"
          severity-cutoff: "high"

      - name: Upload Grype scan results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && steps.grype-scan.outputs.sarif != ''
        with:
          sarif_file: ${{ steps.grype-scan.outputs.sarif }}

  # Secrets scanning
  secrets-scan:
    name: Secrets Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Run TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          # For pull requests, scan the diff; for other events, scan filesystem
          base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || '' }}
          head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || '' }}
          extra_args: --debug --only-verified

  # Kubernetes security scanning
  k8s-security:
    name: Kubernetes Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Helm
        uses: azure/setup-helm@v5
        with:
          version: "3.18.3"

      - name: Template Helm chart
        run: |
          helm template security-test helm/deployment-annotator-controller \
            --set grafana.url=https://test.grafana.com \
            --set grafana.apiKey=test-key \
            --set image.repository=test/image \
            --set image.tag=test > k8s-manifests.yaml

      - name: Install Polaris
        uses: jaxxstorm/action-install-gh-release@v3.0.0
        with:
          repo: FairwindsOps/polaris
          tag: latest
          cache: enable

      - name: Run Polaris security scan
        run: |
          # Create Polaris configuration file
          cat > polaris-config.yaml << 'EOF'
          checks:
            hostIPCSet: danger
            hostPIDSet: danger
            notReadOnlyRootFilesystem: warning
            privilegeEscalationAllowed: danger
            runAsRootAllowed: warning
            runAsPrivileged: danger
            insecureCapabilities: warning
            dangerousCapabilities: danger
            cpuRequestsMissing: warning
            cpuLimitsMissing: warning
            memoryRequestsMissing: warning
            memoryLimitsMissing: warning
            tagNotSpecified: danger
            pullPolicyNotAlways: ignore
            hostNetworkSet: danger
            hostPortSet: warning
            deploymentMissingReplicas: warning
            priorityClassNotSet: ignore
            metadataAndNameMismatched: ignore
          EOF

          # Run Polaris audit on the Kubernetes manifests
          polaris audit --audit-path k8s-manifests.yaml --config polaris-config.yaml --format pretty || true

      - name: Run Kubesec security scan
        run: |
          curl -sSX POST --data-binary @k8s-manifests.yaml https://v2.kubesec.io/scan > kubesec-results.json

          # Check for critical issues
          if jq -e '.[] | select(.score < 0)' kubesec-results.json; then
            echo "Critical security issues found in Kubernetes manifests!"
            jq '.[] | select(.score < 0)' kubesec-results.json
            exit 1
          fi

      - name: Upload Kubesec results
        uses: actions/upload-artifact@v7
        with:
          name: kubesec-results
          path: kubesec-results.json

  # SAST (Static Application Security Testing)
  sast:
    name: Static Application Security Testing
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Configure Git for Go modules
        run: |
          git config --global url."https://github.com/".insteadOf "git@github.com:"
          git config --global url."https://".insteadOf "git://"

      - name: Install gosec
        run: go install github.com/securego/gosec/v2/cmd/gosec@latest

      - name: Run gosec
        run: gosec -no-fail -fmt sarif -out gosec-results.sarif ./...

      - name: Upload gosec results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('gosec-results.sarif') != ''
        with:
          sarif_file: gosec-results.sarif
          category: gosec

      - name: Install Semgrep
        run: python3 -m pip install semgrep

      - name: Run Semgrep
        run: |
          semgrep --config=auto --sarif --output=semgrep-results.sarif ./

      - name: Upload Semgrep results
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('semgrep-results.sarif') != ''
        with:
          sarif_file: semgrep-results.sarif

  # License compliance check
  license-check:
    name: License Compliance
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: ${{ env.GO_VERSION }}

      - name: Install go-licenses
        run: go install github.com/google/go-licenses@latest

      - name: Check licenses
        run: |
          go-licenses check ./...

      - name: Generate license report
        run: |
          go-licenses report ./... > licenses.txt

      - name: Upload license report
        uses: actions/upload-artifact@v7
        with:
          name: license-report
          path: licenses.txt

  # Security summary
  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs:
      [
        codeql,
        dependency-scan,
        container-scan,
        secrets-scan,
        k8s-security,
        sast,
        license-check,
      ]
    if: always()
    steps:
      - name: Security scan summary
        env:
          CODEQL_RESULT: ${{ needs.codeql.result }}
          DEPENDENCY_RESULT: ${{ needs.dependency-scan.result }}
          CONTAINER_RESULT: ${{ needs.container-scan.result }}
          SECRETS_RESULT: ${{ needs.secrets-scan.result }}
          K8S_RESULT: ${{ needs.k8s-security.result }}
          SAST_RESULT: ${{ needs.sast.result }}
          LICENSE_RESULT: ${{ needs.license-check.result }}
        run: |
          echo "## Security Scan Summary 🔒"
          echo ""
          echo "| Scan Type | Status |"
          echo "|-----------|--------|"
          echo "| CodeQL Analysis | $CODEQL_RESULT |"
          echo "| Dependency Scan | $DEPENDENCY_RESULT |"
          echo "| Container Scan | $CONTAINER_RESULT |"
          echo "| Secrets Scan | $SECRETS_RESULT |"
          echo "| Kubernetes Security | $K8S_RESULT |"
          echo "| SAST | $SAST_RESULT |"
          echo "| License Check | $LICENSE_RESULT |"
          echo ""

          # Check if any critical scans failed
          if [[ "$DEPENDENCY_RESULT" == "failure" || \
                "$CONTAINER_RESULT" == "failure" || \
                "$SECRETS_RESULT" == "failure" ]]; then
            echo "❌ Critical security issues detected!"
            exit 1
          else
            echo "✅ All security scans completed successfully!"
          fi