security-audit.yml

name: Security Audit

on:
  push:
    branches: [main]
  pull_request:
    branches: [main, development]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  audit:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v6

      - uses: pnpm/action-setup@v5

      - uses: actions/setup-node@v6
        with:
          node-version: 20
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check for known dependency vulnerabilities
        run: pnpm audit --audit-level=high || echo "::warning::pnpm audit found high-severity vulnerabilities"

      - name: Verify security test count
        run: |
          COUNT=$(pnpm test:run -- src/lib/__tests__/security.test.ts 2>&1 \
            | sed 's/\x1b\[[0-9;]*m//g' \
            | grep 'security\.test\.ts' \
            | grep -oE '[0-9]+ test' \
            | grep -oE '[0-9]+')
          echo "Security tests: $COUNT"
          if [ "$COUNT" -lt 106 ]; then
            echo "::error::Security test count dropped below expected minimum (106). Was a test removed?"
            exit 1
          fi

      - name: Run security audit
        id: security-audit
        continue-on-error: true
        run: |
          pnpm exec tsx scripts/security-audit.ts > /tmp/security-results.json; echo "audit_exit=$?" >> "$GITHUB_OUTPUT"
          cat /tmp/security-results.json

      - name: Verify audit check count
        run: |
          if [ ! -f /tmp/security-results.json ]; then
            echo "::error::Security audit produced no output"
            exit 1
          fi
          TOTAL=$(python3 -c "import json; print(json.load(open('/tmp/security-results.json'))['summary']['total'])")
          echo "Audit checks: $TOTAL"
          if [ "$TOTAL" -lt 36 ]; then
            echo "::error::Audit check count dropped below expected minimum (36). Was a check removed?"
            exit 1
          fi

      - name: Comment on PR with security audit results
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v8
        with:
          script: |
            const fs = require('fs');
            let data;
            try {
              const raw = fs.readFileSync('/tmp/security-results.json', 'utf8');
              data = JSON.parse(raw);
            } catch {
              console.log('No security audit results to comment on.');
              return;
            }

            const { results, summary } = data;
            const hasCritical = summary.critical > 0;
            const hasWarning = summary.warning > 0;

            const icon = hasCritical ? '🚫' : hasWarning ? '⚠️' : '✅';
            const title = hasCritical
              ? `${icon} Security audit failed`
              : hasWarning
                ? `${icon} Security audit passed with warnings`
                : `${icon} Security audit passed`;

            const lines = [`**${title}**`, ''];

            const criticalFails = results.filter(r => r.severity === 'critical' && r.status === 'fail');
            if (criticalFails.length > 0) {
              lines.push('### Critical Failures');
              lines.push('');
              lines.push('| Check | File | Details |');
              lines.push('|---|---|---|');
              for (const r of criticalFails) {
                for (const f of r.findings) {
                  const loc = f.line ? `${f.file}:${f.line}` : f.file;
                  lines.push(`| ${r.name} | \`${loc}\` | ${f.detail} |`);
                }
              }
              lines.push('');
            }

            const warningFails = results.filter(r => r.severity === 'warning' && r.status === 'fail');
            if (warningFails.length > 0) {
              lines.push('### Warnings');
              lines.push('');
              lines.push('| Check | File | Details |');
              lines.push('|---|---|---|');
              for (const r of warningFails) {
                for (const f of r.findings) {
                  const loc = f.line ? `${f.file}:${f.line}` : f.file;
                  lines.push(`| ${r.name} | \`${loc}\` | ${f.detail} |`);
                }
              }
              lines.push('');
            }

            const passed = results.filter(r => r.status === 'pass');
            if (passed.length > 0) {
              lines.push(`### Passed (${passed.length}/${results.length})`);
              lines.push('');
              for (const r of passed) {
                lines.push(`- ✅ ${r.name}`);
              }
              lines.push('');
            }

            lines.push('---');
            lines.push(`**Summary:** ${summary.passed}/${summary.total} checks passed`);
            if (summary.critical > 0) lines.push(` — **${summary.critical} critical failure(s)**`);
            if (summary.warning > 0) lines.push(` — ${summary.warning} warning(s)`);
            lines.push('');
            lines.push('See `scripts/security-audit.ts` for check definitions and `SECURITY.md` for the full security architecture.');

            const body = lines.join('\n');

            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const marker = 'Security audit';
            const existing = comments.find(c =>
              c.user?.login === 'github-actions[bot]' &&
              c.body?.includes(marker)
            );
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Alert if security audit script was modified
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v8
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GH_TOKEN: ${{ github.token }}
        with:
          script: |
            const { data: prFiles } = await github.rest.pulls.listFiles({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              per_page: 100,
            });
            const files = prFiles.map(f => f.filename);

            const auditFiles = files.filter(f =>
              f === 'scripts/security-audit.ts' ||
              f === 'src/lib/__tests__/security.test.ts'
            );

            if (auditFiles.length === 0) return;

            const marker = 'Security audit file modification';
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.find(c =>
              c.user?.login === 'github-actions[bot]' &&
              c.body?.includes(marker)
            );

            const body = [
              `**\u{1F6A8} ${marker} detected**`,
              '',
              'The following security-critical files were changed in this PR:',
              '',
              ...auditFiles.map(f => `- \`${f}\``),
              '',
              'These files guard the security posture of the project. Please review these changes carefully to ensure no checks were weakened or removed.',
            ].join('\n');

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Fail if security audit has critical findings
        if: steps.security-audit.outputs.audit_exit != '0'
        run: exit 1