security-scan.yml

name: Security Scanning & Penetration Testing

on:
  push:
    branches: [ main, develop ]
    paths:
      - '**.rs'
      - '**.yaml'
      - '**.yml'
      - 'charts/**'
      - 'Dockerfile*'
      - 'Makefile'
  pull_request:
    branches: [ main ]

jobs:
  cargo-audit:
    name: Cargo Security Audit
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable
    
    - name: Cargo Audit
      uses: actions-rs/audit-check@v1
      with:
        token: ${{ secrets.GITHUB_TOKEN }}

  trivy-vuln-scan:
    name: Trivy Vulnerability Scanner (Code/FS/Dep/Containers)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Run Trivy vulnerability scanner FS
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-fs-results.sarif'
        severity: 'CRITICAL,HIGH'
    
    - name: Run Trivy vulnerability scanner Cargo
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-cargo-results.sarif'
        severity: 'CRITICAL,HIGH'
        args: ['--scanners', 'vuln', '--vuln-type', 'library']
    
    - name: Upload Trivy scan results FS
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-fs-results.sarif
        
    - name: Upload Trivy cargo results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-cargo-results.sarif

  docker-trivy:
    name: Trivy Container Scan
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Build Docker image
      run: docker build -t stellar-operator:scan .
    
    - name: Run Trivy on Docker image
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: 'stellar-operator:scan'
        format: 'sarif'
        output: 'trivy-docker.sarif'
        severity: 'CRITICAL,HIGH'

    - name: Upload Trivy Docker scan
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: trivy-docker.sarif

  iac-checkov:
    name: IaC Security Scan (Helm/K8s manifests)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Checkov IaC scan
      uses: bridgecrewio/checkov-action@v12
      with:
        directory: charts/
        framework: kubernetes # Helm rendered as K8s
        output_format: sarif
        output_file_path: checkov-results.sarif

    - name: Upload Checkov results
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: checkov-results.sarif

  compliance-kube-bench:
    name: Kubernetes Compliance (CIS Kube-bench)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Run kube-bench
      run: |
        curl -LO \"https://github.com/aquasecurity/kube-bench/releases/download/v0.6.0/kube-bench_${{ matrix.os }}_v0.6.0_linux_amd64.tar.gz\"
        tar -xzf kube-bench_*.tar.gz
        ./kube-bench --benchmark config/stellar-bench.yaml
      env:
        KUBECONFIG: /dev/null # Static analysis mode

  pen-testing-k6:
    name: Penetration Testing Scenarios (k6)
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup k6
      uses: grafana/xk6-action@v2
      with:
        version: 'v0.53.0'
    
    - name: Run k6 penetration test scenarios
      run: |
        mkdir -p benchmarks/security/
        k6 run benchmarks/k6/security-pen-test.js
      env:
        K6_OUT: xk6-cloud # Optional cloud reporting

  security-matrix:
    name: Security Dashboard
    runs-on: ubuntu-latest
    needs: [cargo-audit, trivy-vuln-scan, docker-trivy, iac-checkov, compliance-kube-bench, pen-testing-k6]
    if: always()
    steps:
    - uses: actions/checkout@v4
    - name: Security Status Summary
      run: |
        echo \"## Security Scan Results\" >> $GITHUB_STEP_SUMMARY
        echo \"| Job | Status |\" >> $GITHUB_STEP_SUMMARY
        echo \"|-----|--------|\" >> $GITHUB_STEP_SUMMARY
        for job in cargo-audit trivy-vuln-scan docker-trivy iac-checkov compliance-kube-bench pen-testing-k6; do
          status=\"\${{ needs.$job.result }}\"
          echo \"| $job | \$status |\" >> $GITHUB_STEP_SUMMARY
        done