security.yml

name: Security Scanning

on:
  schedule:
    # Run security scans daily at 2 AM UTC
    - cron: '0 2 * * *'
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]

env:
  PYTHON_VERSION: '3.11'

jobs:
  dependency-check:
    name: Dependency Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install Poetry
        uses: snok/install-poetry@v1

      - name: Install dependencies
        run: poetry install --with dev,test

      - name: Run Safety check
        run: |
          poetry run safety check --json --output safety-report.json
          poetry run safety check --short-report

      - name: Run pip-audit
        run: |
          poetry run pip-audit --desc --format=json --output=pip-audit-report.json
          poetry run pip-audit --desc

      - name: Upload security reports
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: dependency-security-reports
          path: |
            safety-report.json
            pip-audit-report.json

  code-security-scan:
    name: Code Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install Poetry
        uses: snok/install-poetry@v1

      - name: Install dependencies
        run: poetry install --with dev,test

      - name: Run Bandit security scan
        run: |
          poetry run bandit -r src/ -f json -o bandit-report.json
          poetry run bandit -r src/ --severity-level medium

      - name: Run Semgrep security scan
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/secrets
            p/python
          generateSarif: "1"

      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: semgrep.sarif
        if: always()

      - name: Upload security reports
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: code-security-reports
          path: |
            bandit-report.json
            semgrep.sarif

  container-security-scan:
    name: Container Security Scan
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build Docker image
        run: |
          docker build -t forecaster-security-scan:latest .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'forecaster-security-scan:latest'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

      - name: Run Snyk container scan
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: forecaster-security-scan:latest
          args: --severity-threshold=medium
        continue-on-error: true

  infrastructure-security-scan:
    name: Infrastructure Security Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: ${{ env.PYTHON_VERSION }}

      - name: Install CDK
        run: npm install -g aws-cdk@2.100.0

      - name: Install Poetry
        uses: snok/install-poetry@v1

      - name: Install dependencies
        run: poetry install

      - name: Generate CloudFormation templates
        run: |
          cd infra
          poetry run cdk synth --all --no-staging

      - name: Run Checkov IaC security scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: infra/cdk.out
          framework: cloudformation
          output_format: sarif
          output_file_path: checkov-results.sarif

      - name: Upload Checkov scan results
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: checkov-results.sarif

      - name: Run CFN Lint
        run: |
          pip install cfn-lint
          cfn-lint infra/cdk.out/*.template.json --format json --output-file cfn-lint-report.json
          cfn-lint infra/cdk.out/*.template.json

      - name: Upload infrastructure security reports
        uses: actions/upload-artifact@v3
        if: always()
        with:
          name: infrastructure-security-reports
          path: |
            checkov-results.sarif
            cfn-lint-report.json

  secrets-scan:
    name: Secrets Scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run TruffleHog secrets scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
          extra_args: --debug --only-verified

      - name: Run GitLeaks secrets scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          config-path: .gitleaks.toml

  compliance-check:
    name: Compliance Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: AWS Config compliance check
        run: |
          echo "Running AWS Config compliance checks..."
          # Add AWS Config rule validation
          echo "Checking for required tags, encryption, VPC settings, etc."

      - name: GDPR compliance check
        run: |
          echo "Running GDPR compliance checks..."
          # Check for data handling, privacy policies, etc.

      - name: SOC 2 compliance check
        run: |
          echo "Running SOC 2 compliance checks..."
          # Check for security controls, monitoring, etc.

  security-report:
    name: Generate Security Report
    runs-on: ubuntu-latest
    needs: [dependency-check, code-security-scan, container-security-scan, infrastructure-security-scan, secrets-scan]
    if: always()
    steps:
      - name: Download all security reports
        uses: actions/download-artifact@v3

      - name: Generate consolidated security report
        run: |
          echo "# Security Scan Report" > security-report.md
          echo "Generated: $(date)" >> security-report.md
          echo "" >> security-report.md
          
          echo "## Summary" >> security-report.md
          echo "- Dependency Security: ${{ needs.dependency-check.result }}" >> security-report.md
          echo "- Code Security: ${{ needs.code-security-scan.result }}" >> security-report.md
          echo "- Container Security: ${{ needs.container-security-scan.result }}" >> security-report.md
          echo "- Infrastructure Security: ${{ needs.infrastructure-security-scan.result }}" >> security-report.md
          echo "- Secrets Scan: ${{ needs.secrets-scan.result }}" >> security-report.md
          echo "" >> security-report.md
          
          echo "## Recommendations" >> security-report.md
          echo "- Review and address any HIGH or CRITICAL vulnerabilities" >> security-report.md
          echo "- Update dependencies with known vulnerabilities" >> security-report.md
          echo "- Implement additional security controls as needed" >> security-report.md

      - name: Upload consolidated report
        uses: actions/upload-artifact@v3
        with:
          name: security-report
          path: security-report.md

      - name: Comment on PR (if applicable)
        uses: actions/github-script@v6
        if: github.event_name == 'pull_request'
        with:
          script: |
            const fs = require('fs');
            if (fs.existsSync('security-report.md')) {
              const report = fs.readFileSync('security-report.md', 'utf8');
              github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: `## 🔒 Security Scan Results\n\n${report}`
              });
            }