scan.yml

name: Security & Linting

on:
  push:
    branches: [main, dev]
  pull_request:
    branches: [main, dev]

jobs:
  security-lint:
    name: Security & Code Quality Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          
      - name: Verify Node.js version meets requirements
        run: |
          echo "Node.js version:"
          node --version
          echo "npm version:"
          npm --version
          echo "Checking Node.js version compatibility..."
          node -e "
            const version = process.version;
            const major = parseInt(version.slice(1).split('.')[0]);
            const required = 16;
            console.log(\`Node.js \${version} (major: \${major})\`);
            if (major < required) {
              console.error(\`❌ Node.js \${major} is below minimum required version \${required}\`);
              process.exit(1);
            } else {
              console.log(\`✅ Node.js \${major} meets minimum requirement \${required}\`);
            }
          "
          
      - name: Enable Corepack for pnpm
        run: |
          echo "Current Node.js version:"
          node --version
          echo "Enabling Corepack..."
          corepack enable
          echo "Preparing pnpm 9.15.4..."
          corepack prepare pnpm@9.15.4 --activate
          echo "pnpm setup complete"
          
      - name: Verify pnpm version
        run: |
          echo "pnpm version:"
          pnpm --version
          echo "Checking package manager field..."
          node -e "console.log('packageManager:', require('./package.json').packageManager)"
          
      - name: Install dependencies
        run: |
          echo "Installing dependencies with pnpm..."
          echo "Current working directory: $(pwd)"
          echo "Files in directory:"
          ls -la
          echo "Installing..."
          pnpm install --frozen-lockfile
          echo "Dependencies installed successfully"
        
      - name: Verify installation
        run: |
          echo "Checking node_modules..."
          ls -la node_modules/ | head -10
          echo "Checking TypeScript installation..."
          
          # Check TypeScript
          if pnpm tsc --version > /dev/null 2>&1; then
            echo "✅ TypeScript: $(pnpm tsc --version)"
          elif npx tsc --version > /dev/null 2>&1; then
            echo "✅ TypeScript: $(npx tsc --version)"
          else
            echo "⚠️  TypeScript: Not accessible via pnpm/npx, checking package.json..."
            TS_VERSION=$(node -e "const pkg = require('./package.json'); console.log(pkg.devDependencies?.typescript || '')")
            if [ -n "$TS_VERSION" ] && [ "$TS_VERSION" != "undefined" ]; then
              echo "   ✅ TypeScript is listed in devDependencies: $TS_VERSION"
            else
              echo "   ❌ TypeScript may not be installed"
            fi
          fi
          
          echo "✅ Dependency verification completed"
        
      - name: TypeScript compilation check
        run: |
          echo "Running TypeScript compilation check..."
          pnpm tsc --noEmit
          echo "✅ TypeScript compilation successful"
        
      - name: Run ESLint with security rules
        run: |
          echo "Running standard ESLint checks..."
          pnpm lint
          echo "✅ Standard linting passed"
        
      - name: Run security-focused ESLint
        run: |
          echo "Running security-focused ESLint..."
          pnpm lint:security
          echo "✅ Security linting passed"
        
      - name: Audit dependencies for vulnerabilities
        run: |
          echo "Running dependency audit..."
          if pnpm audit --audit-level high; then
            echo "✅ Dependency audit passed - no high/critical vulnerabilities found"
          fi
        
      - name: Check for known security issues
        run: |
          echo "Generating detailed security audit..."
          # Use || true here to ensure JSON output is captured even if vulnerabilities are found
          # This step is for reporting/analysis, not for failing the build
          pnpm audit --json > audit.json || true
          if [ -f audit.json ]; then
            vulnerabilities=$(cat audit.json | jq -r '.data.vulnerabilities // {} | length // 0' 2>/dev/null || echo "0")
            echo "Found $vulnerabilities vulnerabilities"
            echo "✅ Security audit completed"
          else
            echo "No audit data available"
          fi