security.yml

name: Security Scan

on:
  push:
    branches: [main, dev]
    paths:
      - 'api/**'
      - 'admin/**'
      - '.github/workflows/security.yml'
  pull_request:
    branches: [main]
    paths:
      - 'api/**'
      - 'admin/**'
  schedule:
    # 每周一凌晨运行
    - cron: '0 0 * * 1'
  workflow_dispatch:

env:
  GO_VERSION: '1.25.5'

jobs:
  # Go 安全扫描
  go-security:
    name: Go Security Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: ${{ env.GO_VERSION }}
          cache-dependency-path: api/go.sum

      # Gosec v2.22.11 DISABLED temporarily due to tool bugs causing panics on valid Go code
      # Tracking issue: Gosec panics on 11+ directories with "runtime error: invalid memory address or nil pointer dereference"
      # Alternative security checks in place:
      # - govulncheck: Scans for known vulnerabilities in Go dependencies
      # - Trivy: Scans Docker images for vulnerabilities
      # - Gitleaks: Scans for leaked secrets/credentials
      # To re-enable: Update Gosec to a stable version that doesn't panic on our codebase
      #
      # - name: Run Gosec
      #   uses: securego/gosec@master
      #   with:
      #     args: '-exclude-dir=vendor -exclude-dir=docs -fmt=sarif -out=gosec.sarif -severity=high ./api/...'
      #
      # - name: Upload Gosec results
      #   uses: github/codeql-action/upload-sarif@v3
      #   with:
      #     sarif_file: gosec.sarif
      #     category: gosec
      #   if: always()
      #   continue-on-error: true

      - name: Gosec disabled notice
        run: echo "⚠️  Gosec temporarily disabled due to v2.22.11 tool bugs. Using govulncheck, Trivy, and Gitleaks instead."

      # CRITICAL: Security gate - known vulnerabilities fail the build
      - name: Run govulncheck
        working-directory: api
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
          govulncheck -format text ./... 2>&1 | tee vuln-report.txt

          # Check for vulnerabilities
          if grep -q "Vulnerability" vuln-report.txt; then
            echo "::error::Known vulnerabilities found, please review vuln-report.txt"
            exit 1
          fi
          echo "✅ No vulnerabilities found"

      - name: Check for outdated dependencies
        working-directory: api
        run: |
          go list -u -m all 2>/dev/null | grep '\[' || echo "All dependencies are up to date"
        continue-on-error: true

  # Node.js 依赖审计
  npm-audit:
    name: NPM Audit
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: cd admin && npm install --ignore-scripts

      # CRITICAL: Security gate - critical vulnerabilities fail the build
      # Note: High severity vulnerabilities are displayed but don't fail the build
      # Exception: xlsx@0.18.5 has known high-severity vulnerabilities (GHSA-4r6h-8v6p-xvw6, GHSA-5pgg-2g8v-p4x9)
      # but are NOT exploitable in our codebase because we only use xlsx for exporting (writing files),
      # not importing (reading files). The vulnerable functions (XLSX.read, sheet_to_json) are not used.
      - name: Run npm audit
        run: |
          cd admin && npm audit --audit-level=high --json > ../audit-report.json || true

          # Parse and display results
          HIGH=$(cat audit-report.json | jq '.metadata.vulnerabilities.high // 0')
          CRITICAL=$(cat audit-report.json | jq '.metadata.vulnerabilities.critical // 0')

          echo "High: $HIGH, Critical: $CRITICAL"

          # Fail for critical vulnerabilities
          if [ "$CRITICAL" -gt 0 ]; then
            echo "::error::Critical vulnerabilities found: $CRITICAL"
            exit 1
          fi

          # Display warning for high severity vulnerabilities (but don't fail)
          if [ "$HIGH" -gt 0 ]; then
            echo "::warning::High severity vulnerabilities found: $HIGH (review required)"
          fi

          echo "✅ No critical vulnerabilities found"

      - name: Check for outdated packages
        working-directory: admin
        run: npm outdated || true
        continue-on-error: true

  # Docker 镜像扫描
  docker-scan:
    name: Docker Image Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build backend image
        run: docker build -t gamelink-backend:scan ./api

      - name: Build admin image
        run: docker build -t gamelink-admin:scan ./admin

      # CRITICAL: Security gate - CRITICAL vulnerabilities fail the build
      # Note: Only CRITICAL severity is checked. HIGH vulnerabilities are displayed but don't fail.
      # Using --ignore-unfixed to skip vulnerabilities without available fixes.
      # We manually check the SARIF file for CRITICAL vulnerabilities due to Trivy action exit-code issues.
      - name: Run Trivy (backend) - generate SARIF
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'gamelink-backend:scan'
          format: 'sarif'
          output: 'trivy-backend.sarif'
          severity: 'CRITICAL'
          exit-code: '0'
          scan-type: 'image'
          scan-ref: '.'
          ignore-unfixed: true
          vuln-type: 'os,library'

      # CRITICAL: Security gate - CRITICAL vulnerabilities fail the build
      # Note: Only CRITICAL severity is checked. HIGH vulnerabilities are displayed but don't fail.
      # Using --ignore-unfixed to skip vulnerabilities without available fixes.
      # We manually check the SARIF file for CRITICAL vulnerabilities due to Trivy action exit-code issues.
      - name: Run Trivy (admin) - generate SARIF
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'gamelink-admin:scan'
          format: 'sarif'
          output: 'trivy-admin.sarif'
          severity: 'CRITICAL'
          exit-code: '0'
          scan-type: 'image'
          scan-ref: '.'
          ignore-unfixed: true
          vuln-type: 'os,library'

      # Check for CRITICAL vulnerabilities and fail if found
      - name: Check for CRITICAL vulnerabilities (backend)
        run: |
          # SARIF contains all severities, so we filter for CRITICAL only
          # Check the message text for "Severity: CRITICAL"
          HAS_CRITICAL=$(jq '[.runs[0].results[] | select(.message.text | contains("Severity: CRITICAL"))] | length' trivy-backend.sarif)

          if [ "$HAS_CRITICAL" -gt 0 ]; then
            echo "::error::CRITICAL vulnerabilities found in backend image: $HAS_CRITICAL"
            jq '.runs[0].results[] | select(.message.text | contains("Severity: CRITICAL"))' trivy-backend.sarif
            exit 1
          fi
          echo "✅ No CRITICAL vulnerabilities found in backend image"

      # Check for CRITICAL vulnerabilities and fail if found
      - name: Check for CRITICAL vulnerabilities (admin)
        run: |
          # SARIF contains all severities, so we filter for CRITICAL only
          # Check the message text for "Severity: CRITICAL"
          HAS_CRITICAL=$(jq '[.runs[0].results[] | select(.message.text | contains("Severity: CRITICAL"))] | length' trivy-admin.sarif)

          if [ "$HAS_CRITICAL" -gt 0 ]; then
            echo "::error::CRITICAL vulnerabilities found in admin image: $HAS_CRITICAL"
            jq '.runs[0].results[] | select(.message.text | contains("Severity: CRITICAL"))' trivy-admin.sarif
            exit 1
          fi
          echo "✅ No CRITICAL vulnerabilities found in admin image"

      - name: Upload Trivy results (backend)
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-backend.sarif'
          category: 'trivy-backend'
        if: always()
        continue-on-error: true

      - name: Upload Trivy results (admin)
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-admin.sarif'
          category: 'trivy-admin'
        if: always()
        continue-on-error: true

  # 密钥泄露检测
  secret-scan:
    name: Secret Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      # CRITICAL: Security gate - secret leaks fail the build
      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 安全状态汇总
  security-status:
    name: Security Status
    runs-on: ubuntu-latest
    needs: [npm-audit, docker-scan, secret-scan]
    if: always()

    steps:
      - name: Check Security Status
        run: |
          echo "⚠️  Go Security (Gosec): DISABLED - v2.22.11 tool bugs"
          echo "NPM Audit: ${{ needs.npm-audit.result }}"
          echo "Docker Scan: ${{ needs.docker-scan.result }}"
          echo "Secret Scan: ${{ needs.secret-scan.result }}"

          # Fail the job if any security scan failed
          if [[ "${{ needs.npm-audit.result }}" == "failure" ]] || \
             [[ "${{ needs.docker-scan.result }}" == "failure" ]] || \
             [[ "${{ needs.secret-scan.result }}" == "failure" ]]; then
            echo "::error::Security issues detected - scan results above"
            exit 1
          fi

          echo "✅ All active security scans passed"