security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # A weekly run finds a rule or advisory published after the last commit.
    - cron: '23 5 * * 1'

jobs:
  sast:
    name: SAST (CodeQL)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Initialise CodeQL
        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          # HTML is scanned too: every page carries inline script.
          languages: javascript-typescript
          queries: security-and-quality
      - name: Analyse
        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6

  secrets:
    name: Secret scan (Gitleaks)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Anything ever committed is compromised, so the scan reads the whole
          # history. A shallow clone shows only the tip.
          fetch-depth: 0
          persist-credentials: false
      - name: Install Gitleaks
        env:
          # The GitHub Action wrapper needs a paid licence for organisation
          # repositories. The CLI it wraps is MIT, so this installs that.
          GITLEAKS_VERSION: 8.30.1
        run: |
          set -euo pipefail
          cd "$RUNNER_TEMP"
          release="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}"
          curl --proto '=https' --tlsv1.2 -fsSL -O "${release}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl --proto '=https' --tlsv1.2 -fsSL -O "${release}/gitleaks_${GITLEAKS_VERSION}_checksums.txt"
          grep "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
            "gitleaks_${GITLEAKS_VERSION}_checksums.txt" | sha256sum -c -
          tar -xzf "gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" gitleaks
      - name: Scan every commit
        run: |
          "$RUNNER_TEMP/gitleaks" git --no-banner --redact --verbose

  workflows:
    name: Workflow audit (zizmor)
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # The workflows are the only thing here that runs with repository
      # credentials, so they get their own static analysis.
      - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
        with:
          version: 1.29.0

  gates:
    name: Security gates
    runs-on: ubuntu-latest
    needs: [sast, secrets, workflows]
    if: always()
    permissions:
      contents: read
    steps:
      # `needs` alone does not gate: a skipped or cancelled scan satisfies it.
      # This fails unless every scan actually reported success.
      - name: Every scan succeeded
        env:
          RESULTS: ${{ toJSON(needs) }}
        run: |
          set -euo pipefail
          failed=$(echo "$RESULTS" | jq -r '
            to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"
          ')
          if [ -n "$failed" ]; then
            echo "These scans did not succeed:"
            echo "$failed"
            exit 1
          fi
          echo "Every scan succeeded."