security.yml

name: Security Audit (Scheduled)

on:
  schedule:
    # Daily security audit at 02:00 UTC to catch new vulnerabilities
    - cron: "0 2 * * *"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  packages: read

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

concurrency:
  group: security-audit-${{ github.ref }}
  cancel-in-progress: true

jobs:
  action-ref-validation:
    name: "Validate action refs are immutable"
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Validate action refs are immutable
        shell: bash
        run: |
          set -euo pipefail
          mapfile -t workflow_files < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) | sort)
          if [ ${#workflow_files[@]} -eq 0 ]; then
            echo "No workflow files found."
            exit 0
          fi
          mutable_refs=$(grep -nE 'uses:\s*[^#]+@(v[0-9]+|latest|main|master|develop)\b' "${workflow_files[@]}" || true)
          if [ -n "$mutable_refs" ]; then
            echo "❌ Mutable GitHub Action references detected. Pin actions to full commit SHAs."
            echo "$mutable_refs"
            exit 1
          fi
          echo "✅ All action references are pinned to immutable SHAs."

  python-deps:
    name: "Python dependencies (pip-audit)"
    needs: [action-ref-validation]
    uses: ./.github/workflows/pip-audit.yml
    with:
      ignore-vulns: |
        PYSEC-2026-161

  secrets-scan:
    name: "Scan full repo for secrets (Gitleaks)"
    runs-on: ubuntu-latest
    needs: [action-ref-validation]
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: "Scan full repo for secrets (Gitleaks)"
        uses: docker://ghcr.io/gitleaks/gitleaks:v8.21.2
        with:
          args: detect --source=/github/workspace --verbose --no-banner

  codeql-audit:
    name: "CodeQL SAST (Python)"
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Initialize CodeQL
        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: python

      - name: Autobuild
        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

      - name: Analyze
        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          upload: always
          category: /language:python

  docker-scan:
    name: "Docker image scan (Trivy)"
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Build ingestor image for scanning
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          docker build -t ingestor:audit -f Dockerfile .

      - name: "Scan ingestor image: strict (HIGH+CRITICAL)"
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ingestor:audit
          format: table
          ignore-unfixed: true
          scanners: vuln
          vuln-type: os,library
          severity: CRITICAL,HIGH
          exit-code: "1"

      - name: "Scan ingestor image: advisory (MEDIUM+HIGH+CRITICAL, non-blocking)"
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        if: always()
        with:
          image-ref: ingestor:audit
          format: table
          ignore-unfixed: true
          scanners: vuln
          vuln-type: os,library
          severity: MEDIUM,HIGH,CRITICAL
          exit-code: "0"

      - name: Build database image for scanning
        env:
          DOCKER_BUILDKIT: "1"
        run: |
          docker build -t database:audit -f infra/database/Dockerfile .

      - name: "Scan database image: strict (HIGH+CRITICAL)"
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: database:audit
          format: table
          ignore-unfixed: true
          scanners: vuln
          vuln-type: os,library
          severity: CRITICAL,HIGH
          exit-code: "1"

      - name: "Scan database image: advisory (MEDIUM+HIGH+CRITICAL, non-blocking)"
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        if: always()
        with:
          image-ref: database:audit
          format: table
          ignore-unfixed: true
          scanners: vuln
          vuln-type: os,library
          severity: MEDIUM,HIGH,CRITICAL
          exit-code: "0"

  audit-summary:
    name: Audit complete
    runs-on: ubuntu-latest
    needs: [action-ref-validation, python-deps, secrets-scan, codeql-audit, docker-scan]
    if: always()
    steps:
      - name: Report results
        shell: bash
        run: |
          echo "## Security Audit Results" >> "$GITHUB_STEP_SUMMARY"
          echo "| Check | Result |" >> "$GITHUB_STEP_SUMMARY"
          echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY"
          echo "| Action Refs | ${{ needs.action-ref-validation.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Python Deps | ${{ needs.python-deps.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Secrets Scan | ${{ needs.secrets-scan.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| CodeQL | ${{ needs.codeql-audit.result }} |" >> "$GITHUB_STEP_SUMMARY"
          echo "| Docker Scan | ${{ needs.docker-scan.result }} |" >> "$GITHUB_STEP_SUMMARY"

          if [ "${{ needs.action-ref-validation.result }}" != "success" ] || [ "${{ needs.python-deps.result }}" != "success" ] || [ "${{ needs.secrets-scan.result }}" != "success" ] || [ "${{ needs.codeql-audit.result }}" != "success" ] || [ "${{ needs.docker-scan.result }}" != "success" ]; then
            echo ""
            echo "⚠️  Security audit found issues. Review above for details."
            exit 1
          fi
          echo "✅ All security audits passed"