security.yml

name: Security scans

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:
  schedule:
    - cron: "17 4 * * 1"

permissions:
  contents: read

jobs:
  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Run Gitleaks
        run: |
          set -euo pipefail
          docker run --rm \
            -v "${GITHUB_WORKSPACE}:/repo" \
            -w /repo \
            ghcr.io/gitleaks/gitleaks@sha256:cdbb7c955abce02001a9f6c9f602fb195b7fadc1e812065883f695d1eeaba854 \
            detect --source=/repo --config=/repo/.gitleaks.toml --redact --verbose

  actionlint:
    name: actionlint
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Run actionlint
        run: |
          set -euo pipefail
          docker run --rm \
            -v "${GITHUB_WORKSPACE}:/repo" \
            -w /repo \
            docker.io/rhysd/actionlint@sha256:887a259a5a534f3c4f36cb02dca341673c6089431057242cdc931e9f133147e9 \
            -color

  python-security:
    name: Python static/security checks
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Set up Python
        # actions/setup-python v7.0.0
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
        with:
          python-version: "3.12"
          cache: pip

      - name: Install scanners
        run: |
          python -m pip install --upgrade pip
          python -m pip install semgrep==1.168.0 zizmor==1.26.1 pip-audit==2.10.1

      - name: Run Semgrep
        run: semgrep scan --config p/ci --config p/secrets --error --metrics=off .

      - name: Run zizmor
        run: zizmor .github/workflows

      - name: Detect Python dependencies
        id: python-deps
        run: |
          python - <<'PY' >> "$GITHUB_OUTPUT"
          import glob
          import os
          import tomllib
          from pathlib import Path

          requirements_present = bool(glob.glob("requirements*.txt"))
          dependencies = []
          pyproject = Path("pyproject.toml")
          if pyproject.exists():
              data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
              project = data.get("project", {})
              dependencies.extend(project.get("dependencies", []))
              for group in project.get("optional-dependencies", {}).values():
                  dependencies.extend(group)

          dependency_file = Path(os.environ["RUNNER_TEMP"]) / "project-dependencies.txt"
          dependency_file.write_text("\n".join(dependencies), encoding="utf-8")
          present = requirements_present or bool(dependencies)
          print(f"present={str(present).lower()}")
          PY

      - name: Run pip-audit
        if: steps.python-deps.outputs.present == 'true'
        run: |
          set -euo pipefail
          # Audit project manifests explicitly. The ambient environment also
          # contains the security scanners and is not the project's dependency set.
          if compgen -G 'requirements*.txt' > /dev/null; then
            for requirements_file in requirements*.txt; do
              pip-audit --progress-spinner off -r "${requirements_file}"
            done
          fi
          if [[ -s "${RUNNER_TEMP}/project-dependencies.txt" ]]; then
            pip-audit --progress-spinner off -r "${RUNNER_TEMP}/project-dependencies.txt"
          fi

  shellcheck:
    name: ShellCheck
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        # actions/checkout v7.0.1
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
        with:
          persist-credentials: false

      - name: Run ShellCheck when shell scripts exist
        run: |
          set -euo pipefail
          mapfile -t scripts < <(git ls-files '*.sh' '*.bash')
          if [ "${#scripts[@]}" -eq 0 ]; then
            echo "No tracked shell scripts found; skipping ShellCheck."
            exit 0
          fi
          docker run --rm \
            -v "${GITHUB_WORKSPACE}:/mnt" \
            -w /mnt \
            docker.io/koalaman/shellcheck@sha256:bb596a0d169b85ddd81d8b6d3a2ff6d5baf5fca10b97f575ebc647c3dff62b3d \
            -x "${scripts[@]}"