security-checks.yml

# SPDX-License-Identifier: MPL-2.0
# RSR-compliant security validation workflow with SHA-pinned actions

name: Security Checks
on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
permissions:
  contents: read
jobs:
  secret-scanning:
    name: Detect Secrets
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Detect secrets with Gitleaks
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Dependency Review
        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.5.0
        with:
          fail-on-severity: high
          deny-licenses: GPL-3.0, AGPL-3.0
          comment-summary-in-pr: always
  validate-actions:
    name: Validate GitHub Actions
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Check for unpinned actions
        run: |
          echo "Checking for unpinned GitHub Actions..."
          UNPINNED=$(grep -rE "uses:\s+[^@]+@(v[0-9]+|main|master|latest)" .github/workflows/ || true)
          if [ -n "$UNPINNED" ]; then
            echo "::warning::Found potentially unpinned actions (should use SHA pinning):"
            echo "$UNPINNED"
          else
            echo "All actions appear to be SHA-pinned"
          fi
      - name: Check for dangerous permissions
        run: |
          echo "Checking for overly permissive workflow permissions..."
          DANGEROUS=$(grep -rE "permissions:\s*write-all" .github/workflows/ || true)
          if [ -n "$DANGEROUS" ]; then
            echo "::error::Found workflows with write-all permissions:"
            echo "$DANGEROUS"
            exit 1
          fi
          echo "No dangerous permissions found"
  file-validation:
    name: Validate Security Files
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Check required security files exist
        run: |
          MISSING=""
          for file in SECURITY.md LICENSE.txt .github/CODEOWNERS .github/dependabot.yml; do
            if [ ! -f "$file" ]; then
              MISSING="$MISSING $file"
            fi
          done
          if [ -n "$MISSING" ]; then
            echo "::error::Missing required security files:$MISSING"
            exit 1
          fi
          echo "All required security files present"
      - name: Check for template placeholders
        run: |
          echo "Checking for unfilled template placeholders..."
          PLACEHOLDERS=$(grep -rE "\{\{[A-Z_]+\}\}" SECURITY.md CONTRIBUTING.md 2>/dev/null || true)
          if [ -n "$PLACEHOLDERS" ]; then
            echo "::error::Found unfilled template placeholders:"
            echo "$PLACEHOLDERS"
            exit 1
          fi
          echo "No template placeholders found"
  trufflehog:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@main
        with:
          extra_args: --only-verified --fail