php-security.yml

# SPDX-License-Identifier: MPL-2.0
name: PHP Security Check
on:
  push:
    branches: [main, master]
  pull_request:

# Estate guardrail: scope push to default branches so a PR fires once (not
# push+PR), and cancel superseded runs. Safe — read-only PR-triggered check.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main, master]
  pull_request:
permissions:
  contents: read
jobs:
  security:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4.1.1
      - name: PHP Security Scan
        run: |
          # Check for dangerous functions
          DANGEROUS=$(grep -rE 'eval\s*\(|exec\s*\(|system\s*\(|passthru\s*\(|shell_exec\s*\(|`.*\$' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -10 || true)
          if [ -n "$DANGEROUS" ]; then
            echo "⚠️ Potentially dangerous PHP functions found:"
            echo "$DANGEROUS"
          fi

          # Check for SQL injection patterns
          SQLI=$(grep -rE '\$_(GET|POST|REQUEST).*query|mysqli_query.*\$_' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true)
          if [ -n "$SQLI" ]; then
            echo "⚠️ Potential SQL injection patterns:"
            echo "$SQLI"
          fi

          # Check for XSS patterns
          XSS=$(grep -rE 'echo\s+\$_(GET|POST|REQUEST)' --include="*.php" . 2>/dev/null | grep -v 'vendor/' | head -5 || true)
          if [ -n "$XSS" ]; then
            echo "⚠️ Potential XSS patterns (unescaped output):"
            echo "$XSS"
          fi

          echo "✅ PHP security scan completed"