ci-security-scan.yml

name: Security

# CodeQL SAST scanning is handled by GitHub's Default Setup (enabled in repo settings).
# This provides automatic scanning on push/PR with incremental analysis and zero maintenance.
# This workflow handles dependency scanning (Trivy), secret detection (TruffleHog), and
# a freshness check on the RFC 9116 security.txt Expires field.

on:
  workflow_call:
    inputs:
      should_skip:
        description: "Whether to skip the workflow"
        required: false
        type: string
        default: "false"

jobs:
  security-scan:
    name: "Dependencies, secrets, and policy"
    runs-on: ubuntu-latest
    if: inputs.should_skip != 'true'
    timeout-minutes: 10
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Trivy dependency scan
        id: dependencies
        continue-on-error: true
        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # 0.34.2
        with:
          scan-type: "fs"
          scan-ref: "."
          format: "sarif"
          output: "trivy-results.sarif"

      - name: Upload Trivy results
        if: always()
        continue-on-error: true
        uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
        with:
          sarif_file: "trivy-results.sarif"

      - name: Secret detection
        id: secrets
        continue-on-error: true
        uses: trufflesecurity/trufflehog@7c0734f987ad0bb30ee8da210773b800ee2016d3 # v3.93.4
        with:
          path: ./
          base: ${{ github.event_name == 'pull_request' && github.base_ref || '' }}
          head: ${{ github.event_name == 'pull_request' && 'HEAD' || '' }}
          extra_args: --debug --only-verified

      # RFC 9116 requires a valid Expires date. Fail before it lapses so an
      # active branch is forced to renew it — a stale file signals abandonment.
      - name: security.txt freshness
        id: policy
        continue-on-error: true
        run: |
          file="webapp/public/.well-known/security.txt"
          expires="$(grep -i '^Expires:' "$file" | head -1 | cut -d' ' -f2)"
          if [ -z "$expires" ]; then
            echo "::error file=$file::Missing required RFC 9116 Expires field"
            exit 1
          fi

          days=$(( ( $(date -u -d "$expires" +%s) - $(date -u +%s) ) / 86400 ))
          echo "security.txt expires in $days day(s) ($expires)"
          if [ "$days" -lt 30 ]; then
            echo "::error file=$file::Expires is $days day(s) away (<30); renew it per RFC 9116"
            exit 1
          fi

      - name: Evaluate security checks
        id: security
        if: always()
        continue-on-error: true
        env:
          DEPENDENCIES: ${{ steps.dependencies.outcome }}
          SECRETS: ${{ steps.secrets.outcome }}
          POLICY: ${{ steps.policy.outcome }}
        run: |
          failed=false
          for result in "$DEPENDENCIES" "$SECRETS" "$POLICY"; do
            if [ "$result" != "success" ]; then failed=true; fi
          done
          if [ "$failed" = "true" ]; then
            echo "::error::One or more security checks failed; review the independently reported steps above."
            exit 1
          fi

      - name: Resolve released-chain baseline
        id: baseline
        continue-on-error: true
        if: always()
        env:
          PUSH_BEFORE: ${{ github.event.before }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          set -euo pipefail
          BASE=""
          if [ "$GITHUB_EVENT_NAME" = "pull_request" ]; then
            if ! git cat-file -e "$PR_BASE_SHA^{commit}" 2>/dev/null; then
              echo "::error::PR base commit $PR_BASE_SHA is not in local history — this job needs fetch-depth: 0. Refusing to pass without checking."
              exit 1
            fi
            BASE="$PR_BASE_SHA"
          elif [ -n "$PUSH_BEFORE" ] && git cat-file -e "$PUSH_BEFORE^{commit}" 2>/dev/null; then
            BASE="$PUSH_BEFORE"
          fi
          echo "base=$BASE" >> "$GITHUB_OUTPUT"
          echo "Baseline: ${BASE:-<none — no reachable previous tip, nothing to enforce>}"

      - name: Changelog immutability guard
        id: changelog-policy
        continue-on-error: true
        if: steps.baseline.outputs.base != ''
        env:
          BASE: ${{ steps.baseline.outputs.base }}
          RELEASED_REF: ${{ github.event_name == 'pull_request' && github.base_ref || 'main' }}
        run: |
          set -euo pipefail
          CHANGELOG_DIR="server/src/main/resources/db/changelog"
          MASTER="server/src/main/resources/db/master.xml"
          FAILED=false

          VIOLATIONS=$(git diff --name-only --diff-filter=MDR "$BASE" HEAD -- "$CHANGELOG_DIR")
          if [ -n "$VIOLATIONS" ]; then
            FAILED=true
            echo "::error::Released Liquibase changesets were modified, renamed, or deleted. Ship a new follow-up changelog instead:"
            echo "$VIOLATIONS"
          fi

          git show "$BASE:$MASTER" 2>/dev/null | grep '<include ' > /tmp/includes-base || true
          grep '<include ' "$MASTER" > /tmp/includes-head || true
          if [ -s /tmp/includes-base ] && ! diff /tmp/includes-base <(head -n "$(wc -l < /tmp/includes-base)" /tmp/includes-head) >/dev/null; then
            FAILED=true
            echo "::error::master.xml is append-only: an existing <include> was removed, reordered, or edited. New changelogs go at the end of the list."
          fi

          if [ "$FAILED" = "true" ]; then
            {
              echo "### Changelog immutability"
              echo "Changesets that reached \`$RELEASED_REF\` may already be applied to production databases — editing or removing them breaks the upgrade path (checksum errors or silently orphaned changesets)."
              echo "Fix forward with a **new** changelog appended to \`master.xml\`. See \`docs/contributor/database-migration.mdx\`."
            } >> "$GITHUB_STEP_SUMMARY"
            exit 1
          fi
          echo "No released changeset was touched; master.xml stays append-only."

      - name: Assert no legacy agent-image references
        id: legacy-image-policy
        continue-on-error: true
        if: always()
        run: |
          set -euo pipefail
          NEEDLE="agent-$(printf 'open\x63ode')"
          if grep -rEnI "$NEEDLE" \
                --exclude-dir=node_modules --exclude-dir=target --exclude-dir=.git \
                . \
              | grep -vE '^\./(MIGRATION\.md|docs/admin/agent-image-digests\.md):' ; then
            echo "::error::Legacy agent image is removed in issue #1076; relocate any new references to MIGRATION.md."
            exit 1
          fi
      - name: Assert no release-channel agent image references
        id: release-channel-policy
        continue-on-error: true
        if: always()
        run: |
          set -euo pipefail
          NEEDLE="agent-pi:$(printf 'lat\x65st')"
          if grep -rEnI "$NEEDLE" \
                --exclude-dir=node_modules --exclude-dir=target --exclude-dir=.git \
                . \
              | grep -vE '^\./(MIGRATION\.md|docs/admin/agent-image-digests\.md|docs/decisions/0031-.*\.md|server/src/test/java/de/tum/cit/aet/hephaestus/agent/sandbox/AgentImageReferenceGuardTest\.java):' ; then
            echo "::error::A release-channel agent image tag resolves to another release's image (ADR 0031). Leave the reference unset so it follows this deployment's image tag, or pin a digest."
            exit 1
          fi

      - name: Assert no legacy agent-image-pin.env references
        id: legacy-pin-policy
        continue-on-error: true
        if: always()
        run: |
          set -euo pipefail
          if grep -rEnI 'docker/agent-image-pin(\.local)?\.env' \
                --exclude-dir=node_modules --exclude-dir=target --exclude-dir=.git \
                . \
              | grep -vE '^\./(MIGRATION\.md|docs/admin/agent-image-digests\.md):' \
              | grep -vE '^\./scripts/check-agent-instructions\.ts:[0-9]+:[[:space:]]*value: "docker/agent-image-pin(\.local)?\.env",$' ; then
            echo "::error::Legacy pin-file names are allowed only in migration history, the digest guide, and exact instruction-checker exceptions."
            exit 1
          fi

      - name: Evaluate security and repository policy
        if: always()
        env:
          SECURITY: ${{ steps.security.outcome }}
          BASELINE: ${{ steps.baseline.outcome }}
          CHANGELOG: ${{ steps.changelog-policy.outcome }}
          LEGACY_IMAGE: ${{ steps.legacy-image-policy.outcome }}
          RELEASE_CHANNEL: ${{ steps.release-channel-policy.outcome }}
          LEGACY_PIN: ${{ steps.legacy-pin-policy.outcome }}
        run: |
          failed=false
          for result in "$SECURITY" "$BASELINE" "$CHANGELOG" "$LEGACY_IMAGE" "$RELEASE_CHANNEL" "$LEGACY_PIN"; do
            if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then failed=true; fi
          done
          if [ "$failed" = "true" ]; then
            echo "::error::One or more security or repository policy checks failed; review the independently reported steps above."
            exit 1
          fi