security.yml

name: Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Run daily at 2 AM UTC
    - cron: '0 2 * * *'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  PYTHON_VERSION: "3.13"
  UV_VERSION: "latest"

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Dependency Review
        uses: actions/dependency-review-action@v4
        with:
          fail-on-severity: moderate
          deny-licenses: GPL-3.0, AGPL-3.0
          comment-summary-in-pr: on-failure

  bandit:
    name: Bandit Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: ${{ env.UV_VERSION }}

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Run bandit security scan
        run: |
          uv run --with "bandit[toml]" bandit -r ea_agentgate/ server/ \
            -f json \
            -o bandit-report.json \
            --severity-level medium \
            --confidence-level medium || true

      - name: Generate bandit SARIF report
        run: |
          uv run --with "bandit[toml]" bandit -r ea_agentgate/ server/ \
            -f sarif \
            -o bandit-results.sarif \
            --severity-level medium \
            --confidence-level medium || true

      - name: Upload bandit results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('bandit-results.sarif') != ''
        with:
          sarif_file: bandit-results.sarif
          category: bandit

      - name: Upload bandit report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: bandit-report
          path: bandit-report.json
          retention-days: 30

  safety:
    name: Safety Vulnerability Scan
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: ${{ env.UV_VERSION }}

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          uv sync --extra all --extra enterprise --extra dev

      - name: Run safety check
        run: |
          uv run --with safety safety check \
            --json \
            --output safety-report.json || true

      - name: Display safety summary
        if: always()
        run: |
          if [ -f safety-report.json ]; then
            echo "## Safety Vulnerability Report" >> $GITHUB_STEP_SUMMARY
            echo '```json' >> $GITHUB_STEP_SUMMARY
            cat safety-report.json | head -50 >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload safety report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: safety-report
          path: safety-report.json
          retention-days: 30

  pip-audit:
    name: Pip Audit
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: ${{ env.UV_VERSION }}

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Export pinned runtime requirements
        run: |
          uv export \
            --no-dev \
            --extra server \
            --no-editable \
            --no-hashes \
            -o requirements-audit-server.txt

      - name: Run pip-audit
        run: |
          uv run --with pip-audit pip-audit \
            --requirement requirements-audit-server.txt \
            --no-deps \
            --format json \
            --output pip-audit-report.json \
            --skip-editable \
            --progress-spinner off || true

      - name: Generate pip-audit summary
        if: always()
        run: |
          if [ -f pip-audit-report.json ]; then
            echo "## Pip Audit Report" >> $GITHUB_STEP_SUMMARY
            echo '```json' >> $GITHUB_STEP_SUMMARY
            cat pip-audit-report.json >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          fi

      - name: Upload pip-audit report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: pip-audit-report
          path: pip-audit-report.json
          retention-days: 30

  trivy:
    name: Trivy Filesystem Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH,MEDIUM'
          skip-dirs: 'tests,docs'

      - name: Upload Trivy results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: trivy-results.sarif
          category: trivy-fs

      - name: Run Trivy with JSON output
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'json'
          output: 'trivy-report.json'
          severity: 'CRITICAL,HIGH,MEDIUM'
          skip-dirs: 'tests,docs'

      - name: Upload Trivy report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: trivy-report
          path: trivy-report.json
          retention-days: 30

  codeql:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 20

    permissions:
      security-events: write
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        language: ['python']

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:${{ matrix.language }}"

  secret-scan:
    name: Secret Scanning
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: TruffleHog Secret Scan
        uses: trufflesecurity/trufflehog@main
        continue-on-error: true
        with:
          path: ./
          extra_args: --only-verified --json

  semgrep:
    name: Semgrep SAST
    runs-on: ubuntu-latest
    timeout-minutes: 15

    container:
      image: returntocorp/semgrep

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Run Semgrep
        run: |
          semgrep scan \
            --config=auto \
            --sarif \
            --output=semgrep-results.sarif
        continue-on-error: true

      - name: Upload Semgrep results to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('semgrep-results.sarif') != ''
        with:
          sarif_file: semgrep-results.sarif
          category: semgrep

  license-check:
    name: License Compliance
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          version: ${{ env.UV_VERSION }}

      - name: Set up Python
        run: uv python install ${{ env.PYTHON_VERSION }}

      - name: Install dependencies
        run: |
          uv sync --extra all --extra enterprise --extra dev

      - name: Check licenses
        run: |
          uv run --with pip-licenses pip-licenses \
            --format=json \
            --output-file=licenses-report.json \
            --with-urls \
            --with-description

      - name: Verify no GPL licenses
        run: |
          if grep -iE "GPL-3|AGPL" licenses-report.json; then
            echo "::error::GPL/AGPL licenses found in dependencies"
            exit 1
          fi

      - name: Upload license report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: licenses-report
          path: licenses-report.json
          retention-days: 30

  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [bandit, safety, pip-audit, trivy, codeql, secret-scan, semgrep, license-check]
    if: always()
    timeout-minutes: 5

    steps:
      - name: Download all reports
        uses: actions/download-artifact@v4
        continue-on-error: true

      - name: Generate security summary
        run: |
          echo "# Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "## Job Results" >> $GITHUB_STEP_SUMMARY
          echo "- Bandit: ${{ needs.bandit.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Safety: ${{ needs.safety.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Pip Audit: ${{ needs.pip-audit.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Trivy: ${{ needs.trivy.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- CodeQL: ${{ needs.codeql.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Secret Scan: ${{ needs.secret-scan.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- Semgrep: ${{ needs.semgrep.result }}" >> $GITHUB_STEP_SUMMARY
          echo "- License Check: ${{ needs.license-check.result }}" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Detailed reports are available in the workflow artifacts." >> $GITHUB_STEP_SUMMARY

      - name: Check security status
        run: |
          if [[ "${{ needs.bandit.result }}" == "failure" ]] || \
             [[ "${{ needs.safety.result }}" == "failure" ]] || \
             [[ "${{ needs.pip-audit.result }}" == "failure" ]] || \
             [[ "${{ needs.trivy.result }}" == "failure" ]] || \
             [[ "${{ needs.codeql.result }}" == "failure" ]] || \
             [[ "${{ needs.secret-scan.result }}" == "failure" ]] || \
             [[ "${{ needs.semgrep.result }}" == "failure" ]] || \
             [[ "${{ needs.license-check.result }}" == "failure" ]]; then
            echo "::error::One or more security scans reported issues. Review the reports."
            exit 1
          else
            echo "::notice::All security scans completed successfully"
          fi