security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly: every Monday at 06:00 UTC.
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  pip-audit:
    name: pip-audit (dependencies)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: pyproject.toml

      - name: Install package and pip-audit
        run: |
          python -m pip install --upgrade pip
          pip install -e ".[blockchain]"
          pip install "pip-audit>=2.7"

      - name: Run pip-audit
        # Advisory on PR, enforced on schedule + push to main.
        # --skip-editable skips the locally-installed editable attestix itself.
        # No --strict: under --strict pip-audit fails on any un-auditable dep,
        # and an editable self-install can never be audited (it errors even with
        # --skip-editable). Without --strict, pip-audit still exits non-zero on
        # any real dependency vulnerability — which is the behaviour we enforce.
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            pip-audit --progress-spinner off --skip-editable || echo "pip-audit findings present (advisory on PR)."
          else
            pip-audit --progress-spinner off --skip-editable
          fi

  bandit:
    name: bandit (source code SAST)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: pyproject.toml

      - name: Install bandit
        run: |
          python -m pip install --upgrade pip
          pip install "bandit[toml]>=1.7"

      - name: Run bandit (medium+ severity, medium+ confidence)
        run: bandit -r services tools auth blockchain api -c pyproject.toml -ll -ii

  safety:
    name: safety (CVE scan, advisory)
    runs-on: ubuntu-latest
    continue-on-error: true
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: '3.12'
          cache: 'pip'
          cache-dependency-path: pyproject.toml

      - name: Install safety
        run: |
          python -m pip install --upgrade pip
          pip install "safety>=3.2"

      - name: Run safety check
        run: safety check --file=requirements.txt --full-report || true