security-checks.yml

# SPDX-License-Identifier: MPL-2.0
# RSR-compliant security validation workflow with SHA-pinned actions

name: Security Checks

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions: read-all

jobs:
  secret-scanning:
    name: Detect Secrets
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Detect secrets with Gitleaks
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v2.3.8
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4.5.0
        with:
          fail-on-severity: high
          # Replaces the previous `deny-licenses: GPL-3.0, AGPL-3.0`. The
          # `deny-licenses` option is deprecated for removal in the next
          # major release (actions/dependency-review-action#997): when no
          # SBOM is available it can't actually evaluate a denylist, so it
          # fails-open silently. `allow-licenses` fails-closed: anything
          # not on this list (including the strong-copyleft GPL-3.0 /
          # AGPL-3.0 we want to keep out) blocks the PR.
          #
          # Scope: permissive + weak-copyleft licenses compatible with this
          # repo's PMPL distribution. Adjust if a legitimate dep gets
          # blocked — do NOT slip GPL-3.0 / AGPL-3.0 back in.
          allow-licenses: >-
            Apache-2.0,
            BSD-2-Clause,
            BSD-3-Clause,
            BSD-3-Clause-Clear,
            CC0-1.0,
            ISC,
            LGPL-2.1-only,
            LGPL-2.1-or-later,
            LGPL-3.0-only,
            LGPL-3.0-or-later,
            MIT,
            MPL-2.0,
            PSF-2.0,
            Python-2.0,
            Unlicense,
            Zlib
          comment-summary-in-pr: always

  validate-actions:
    name: Validate GitHub Actions
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check for unpinned actions
        run: |
          echo "Checking for unpinned GitHub Actions..."
          UNPINNED=$(grep -rE "uses:\s+[^@]+@(v[0-9]+|main|master|latest)" .github/workflows/ || true)
          if [ -n "$UNPINNED" ]; then
            echo "::warning::Found potentially unpinned actions (should use SHA pinning):"
            echo "$UNPINNED"
          else
            echo "All actions appear to be SHA-pinned"
          fi

      - name: Check for dangerous permissions
        run: |
          echo "Checking for overly permissive workflow permissions..."
          DANGEROUS=$(grep -rE "permissions:\s*write-all" .github/workflows/ || true)
          if [ -n "$DANGEROUS" ]; then
            echo "::error::Found workflows with write-all permissions:"
            echo "$DANGEROUS"
            exit 1
          fi
          echo "No dangerous permissions found"

  file-validation:
    name: Validate Security Files
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Check required security files exist
        run: |
          MISSING=""
          for file in SECURITY.md LICENSE.txt .github/CODEOWNERS .github/dependabot.yml; do
            if [ ! -f "$file" ]; then
              MISSING="$MISSING $file"
            fi
          done
          if [ -n "$MISSING" ]; then
            echo "::error::Missing required security files:$MISSING"
            exit 1
          fi
          echo "All required security files present"

      - name: Check for template placeholders
        run: |
          echo "Checking for unfilled template placeholders..."
          PLACEHOLDERS=$(grep -rE "\{\{[A-Z_]+\}\}" SECURITY.md CONTRIBUTING.md 2>/dev/null || true)
          if [ -n "$PLACEHOLDERS" ]; then
            echo "::error::Found unfilled template placeholders:"
            echo "$PLACEHOLDERS"
            exit 1
          fi
          echo "No template placeholders found"