security-test.yml

name: Security Tests

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to test'
        required: true
        default: 'dev'
        type: choice
        options:
          - dev
          - prod

jobs:
  security-test:
    name: Run Security Tests for ${{ inputs.environment }}
    runs-on: ubuntu-latest
    environment: ${{ inputs.environment }}
    
    steps:
      - name: Determine Branch
        id: branch
        run: |
          if [ "${{ inputs.environment }}" = "prod" ]; then
            echo "ref=main" >> $GITHUB_OUTPUT
          else
            echo "ref=develop" >> $GITHUB_OUTPUT
          fi
          
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.branch.outputs.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci --legacy-peer-deps

      - name: Restore IMS token cache
        uses: actions/cache@v4
        with:
          path: .ims-token-${{ inputs.environment }}-cache.json
          # Static cache key - expires when token is invalid (checked by imsHelper.js)
          # Change the version number (v1) to force cache invalidation if needed
          key: ims-token-${{ inputs.environment }}-${{ github.repository }}-v1
          restore-keys: |
            ims-token-${{ inputs.environment }}-${{ github.repository }}-

      - name: Select Environment Configuration
        id: config
        run: |
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            ENV="${{ inputs.environment }}"
          else
            # Default to dev for automatic triggers
            ENV="dev"
          fi
          echo "using code from branch: ${{ steps.branch.outputs.ref }}"
          echo "environment=$ENV" >> $GITHUB_OUTPUT
          echo "Running security tests for: $ENV"
          
          # Set environment-specific variables
          if [ "$ENV" = "prod" ]; then
            echo "apim_endpoint=${{ vars.APIM_ENDPOINT_PROD }}" >> $GITHUB_OUTPUT
            echo "function_endpoint=${{ vars.FUNCTION_ENDPOINT_PROD }}" >> $GITHUB_OUTPUT
            echo "ims_token=${{ secrets.IMS_TOKEN_PERSONAL_PROD }}" >> $GITHUB_OUTPUT
            echo "client_id=${{ secrets.CLIENT_ID_PROD }}" >> $GITHUB_OUTPUT
            echo "client_secret=${{ secrets.CLIENT_SECRET_PROD }}" >> $GITHUB_OUTPUT
            echo "ims_token_url=${{ vars.IMS_TOKEN_URL_PROD }}" >> $GITHUB_OUTPUT
            echo "connection_string=${{ secrets.AZURE_STORAGE_CONNECTION_STRING_PROD }}" >> $GITHUB_OUTPUT
          else
            echo "apim_endpoint=${{ vars.APIM_ENDPOINT_STAGE }}" >> $GITHUB_OUTPUT
            echo "function_endpoint=${{ vars.FUNCTION_ENDPOINT_STAGE }}" >> $GITHUB_OUTPUT
            echo "ims_token=${{ secrets.IMS_TOKEN_PERSONAL_STAGE }}" >> $GITHUB_OUTPUT
            echo "client_id=${{ secrets.CLIENT_ID_STAGE }}" >> $GITHUB_OUTPUT
            echo "client_secret=${{ secrets.CLIENT_SECRET_STAGE }}" >> $GITHUB_OUTPUT
            echo "ims_token_url=${{ vars.IMS_TOKEN_URL_STAGE }}" >> $GITHUB_OUTPUT
            echo "connection_string=${{ secrets.AZURE_STORAGE_CONNECTION_STRING_STAGE }}" >> $GITHUB_OUTPUT
          fi

      - name: Run Security Tests
        env:
          # Environment-specific configuration (set in previous step)
          APIM_ENDPOINT: ${{ steps.config.outputs.apim_endpoint }}
          FUNCTION_ENDPOINT: ${{ steps.config.outputs.function_endpoint }}
          IMS_TOKEN: ${{ steps.config.outputs.ims_token }}
          IMS_CLIENT_ID: ${{ steps.config.outputs.client_id }}
          IMS_CLIENT_SECRET: ${{ steps.config.outputs.client_secret }}
          IMS_TOKEN_URL: ${{ steps.config.outputs.ims_token_url }}
          
          # Azure Storage connection string (for usage tracking test - Test 7)
          AZURE_STORAGE_CONNECTION_STRING: ${{ steps.config.outputs.connection_string }}
          
          # CI flag and cache environment
          CI: true
          CACHE_ENV: ${{ inputs.environment }}
        run: |
          npm run test:security