security.yml

name: Security Scanning

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Run security scan weekly on Monday at 9am UTC
    - cron: "0 9 * * 1"
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  npm-audit:
    name: NPM Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 20
          cache: "npm"

      - name: Run npm audit
        run: |
          npm audit --production --audit-level=moderate || true

  osv-scanner:
    name: OSV Scanner
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@c5996e0193a3df57d695c1b8a1dec2a4c62e8730 # v2.3.3
    permissions:
      actions: read
      security-events: write
      contents: read
    with:
      scan-args: |-
        -r
        ./

  codeql-javascript:
    name: CodeQL JavaScript/TypeScript Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Initialize CodeQL
        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          languages: javascript-typescript
          queries: security-and-quality
          config: |
            paths-ignore:
              - '**/src/upstream/**'
              - '**/node_modules/**'
              - '**/build/**'
              - '**/prebuilds/**'
              - '**/dist/**'
              - '**/coverage/**'
              - '**/vendored/**'
              - '**/third-party/**'
              - '**/test/**'
              - '**/test-directory/**'

      - name: Autobuild
        uses: github/codeql-action/autobuild@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6

  codeql-cpp:
    name: CodeQL C++ Analysis
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive

      - name: Setup build environment
        run: |
          sudo apt-get update
          sudo apt-get install -y python3 make g++ gcc

      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version: 20
          cache: "npm"

      - name: Install dependencies
        run: npm ci

      - name: Initialize CodeQL
        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          languages: cpp
          queries: security-and-quality

      - name: Build C++ code
        run: npm run build:native:rebuild

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          upload: false
          output: sarif-results

      # Filter false positives and upstream code from results
      # - cpp/slicing: All instances are N-API wrapper classes (Napi::Buffer,
      #   Napi::BigInt, etc.) assigned to Napi::Value. This is intentional and
      #   safe - these are thin wrappers around napi_value handles, and slicing
      #   only loses cached C++ state, not the underlying JS value reference.
      #   See: https://github.com/nodejs/node-addon-api/blob/main/doc/value.md
      - name: Filter upstream code from SARIF
        uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
        with:
          patterns: |
            -**/src/upstream/**
            -**/node_modules/**
            -**:cpp/slicing
          input: sarif-results/cpp.sarif
          output: sarif-results/cpp.sarif

      - name: Upload filtered SARIF
        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          sarif_file: sarif-results/cpp.sarif

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Dependency Review
        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          fail-on-severity: moderate
          deny-licenses: AGPL-3.0, GPL-3.0

  secrets-scan:
    name: Secrets Scanning
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: TruffleHog OSS
        uses: trufflesecurity/trufflehog@c3e599b7163e8198a55467f3133db0e7b2a492cb # v3.93.7
        with:
          path: ./
          base: ${{ github.event.repository.default_branch }}
          head: HEAD
          extra_args: --exclude-paths .trufflehog-exclude.txt --only-verified
        continue-on-error: true

  summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [npm-audit, osv-scanner, codeql-javascript, codeql-cpp, secrets-scan]
    if: always()
    steps:
      - name: Summary
        run: |
          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| NPM Audit | ${{ needs.npm-audit.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| OSV Scanner | ${{ needs.osv-scanner.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| CodeQL JS/TS | ${{ needs.codeql-javascript.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| CodeQL C++ | ${{ needs.codeql-cpp.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Secrets Scan | ${{ needs.secrets-scan.result }} |" >> $GITHUB_STEP_SUMMARY