0pt/.gitea/workflows/security.yml

name: Security Scan (SIAX Cloud)

# BACKLOG P0-16, P0-19, P1-14: this used to run Trivy with `--exit-code 0`,
# i.e. purely advisory -- findings never blocked a merge. It now fails the
# build for real on HIGH/CRITICAL, plus a dedicated gitleaks step (REPO-15:
# the only prior secret sweep was hand-rolled regex, not a real
# secret-scanning tool), plus an SBOM + license inventory as build artifacts.
#
# `services/scrapers/` is excluded from the Trivy scan (--skip-dirs).
# Findings there (waf_bypass.py, engine*.py, curl_cffi/cloudscraper/nodriver)
# are expected and out of scope for CI gating -- kept per the account
# owner's dated, attributed decision (Simon Axelsson, 2026-08-11; see
# SECURITY.md and docs/compliance/GOLDEN-STANDARD-REPORT.md control C6).
# That question is explicitly out of scope for this workflow change and
# must not be the reason this gate starts failing for everyone. Every other
# path in the repo is now enforced for real, including the rest of
# services/ (the FastAPI engine itself).
on:
  push:
    branches: ["**"]
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * 1" # weekly Monday re-scan

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Install Trivy (pinned)
        run: |
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.73.0
      - name: Trivy fs scan (vuln + secrets -- BLOCKING)
        run: |
          trivy fs --scanners vuln,secret --severity HIGH,CRITICAL \
            --skip-dirs services/scrapers \
            --exit-code 1 .
      - name: SBOM (CycloneDX, informational artifact -- BACKLOG P1-14)
        if: always()
        run: |
          trivy fs --format cyclonedx --output sbom.cdx.json --skip-dirs services/scrapers .
      - name: Upload SBOM
        if: always()
        continue-on-error: true # informational artifact; must never block the blocking scan above
        uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
        with:
          name: sbom-cyclonedx
          path: sbom.cdx.json
          retention-days: 90

  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          fetch-depth: 0 # gitleaks needs full history, not just the tip commit
      - name: Install gitleaks (pinned + checksum-verified)
        run: |
          curl -sSL -o gitleaks.tar.gz https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  gitleaks.tar.gz" | sha256sum -c -
          tar -xzf gitleaks.tar.gz gitleaks
          sudo mv gitleaks /usr/local/bin/gitleaks
      - name: gitleaks scan (full history -- BLOCKING)
        run: gitleaks detect --source . --log-opts="--all" --redact --verbose

  license-inventory:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "22"
      - name: Enable corepack + pin pnpm@9
        run: |
          corepack enable
          corepack prepare pnpm@9 --activate
      - name: Install (frozen lockfile)
        run: pnpm install --frozen-lockfile
      - name: License inventory (informational -- BACKLOG P1-14)
        run: |
          pnpm licenses list --json > licenses.json || true
          pnpm licenses list
      - uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 (Gitea Actions runner rejects v4 artifacts -- verified empirically 2026-08-11)
        continue-on-error: true # informational artifact; must never block CI
        with:
          name: license-inventory
          path: licenses.json
          retention-days: 90