security-scans.yaml

# Security Scans - Comprehensive security checks
#
# Jobs:
# - Dependency Review (always)
# - Shellcheck (shell scripts)
# - YAML Lint (workflows, charts)
# - Helm Lint (charts/)
# - Hadolint (Dockerfiles)
# - Trivy (filesystem + IaC)
# - CodeQL (Go)
# - Action Pinning (informational)
#
name: Security Scans

on:
  pull_request:
    branches: [main]

permissions: {}

jobs:
  # ============================================================================
  # Phase 0: Foundations
  # ============================================================================

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    # TODO: Remove continue-on-error after enabling Dependency Graph in
    # repo Settings > Code security and analysis
    continue-on-error: true
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294  # v4
        with:
          fail-on-severity: moderate
          deny-licenses: GPL-3.0, AGPL-3.0
          comment-summary-in-pr: never

  shellcheck:
    name: Shell Script Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install shellcheck
        run: sudo apt-get install -y shellcheck

      - name: Run shellcheck
        run: |
          SCRIPTS=$(find . -name "*.sh" -type f 2>/dev/null | grep -v ".git/" || true)
          if [ -z "$SCRIPTS" ]; then
            echo "No shell scripts found"
            exit 0
          fi
          echo "Found scripts:"
          echo "$SCRIPTS"
          echo ""
          FAILED=0
          for script in $SCRIPTS; do
            echo "Checking: $script"
            if ! shellcheck --severity=error "$script"; then
              FAILED=1
            fi
          done
          if [ $FAILED -eq 1 ]; then
            echo "ERROR: Some scripts have shellcheck errors."
            exit 1
          fi
          echo "All scripts passed shellcheck (error level)"

  # ============================================================================
  # Phase A: Linting
  # ============================================================================

  yamllint:
    name: YAML Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Install yamllint
        run: pip install yamllint==1.*

      - name: Create config
        run: |
          cat > .yamllint.yaml << 'EOF'
          extends: relaxed
          ignore: |
            charts/*/templates/
          rules:
            line-length:
              max: 150
              level: warning
            truthy:
              check-keys: false
            document-start: disable
            comments:
              min-spaces-from-content: 1
            indentation:
              spaces: 2
              indent-sequences: whatever
          EOF

      - name: Lint YAML files
        run: |
          yamllint -c .yamllint.yaml \
            .github/workflows/ \
            charts/ || true
          echo ""
          echo "=== Summary ==="
          yamllint -c .yamllint.yaml -f parsable \
            .github/workflows/ charts/ > /tmp/yamllint_output.txt 2>&1 || true
          ERROR_COUNT=$(grep -c ":error:" /tmp/yamllint_output.txt 2>/dev/null || echo "0")
          echo "Errors: $ERROR_COUNT"
          if [ "$ERROR_COUNT" -gt 0 ] 2>/dev/null; then
            echo "ERROR: YAML files have syntax errors."
            exit 1
          fi

  helm-lint:
    name: Helm Chart Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Set up Helm
        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5.0.1
        with:
          version: 'v3.14.0'

      - name: Lint Helm charts
        run: |
          for chart in charts/*/; do
            if [ -f "$chart/Chart.yaml" ]; then
              echo "Linting: $chart"
              # Informational only — don't fail on pre-existing chart issues
              helm lint "$chart" 2>&1 || true
              echo ""
            fi
          done

      - name: Install yq
        uses: mikefarah/yq@c14f446382944492701b16c1ddb48bb9dbe683e3  # v4

      - name: Guard — AuthBridge injection images must be version-pinned (no floating tags)
        # Catches a :latest / floating-tag regression at PR-review time rather than
        # mid-release (rossoctl/rossoctl#508). Positive assertion: every injection image
        # must carry a :vX.Y.Z tag, in BOTH the chart values and the compiled Go fallbacks
        # (config/defaults.go, which the platform-config ConfigMap overlays on top of — a
        # no-ConfigMap deploy would otherwise still inject :latest).
        run: |
          set -euo pipefail
          fail=0
          for k in envoyProxy authbridge authbridgeLite proxyInit; do
            img=$(yq ".defaults.images.$k" charts/operator/values.yaml)
            if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
              echo "::error file=charts/operator/values.yaml::defaults.images.$k not version-pinned: $img"
              fail=1
            fi
          done
          while IFS= read -r img; do
            if [[ ! "$img" =~ :v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
              echo "::error file=operator/internal/webhook/config/defaults.go::compiled default not version-pinned: $img"
              fail=1
            fi
          done < <(grep -oE 'ghcr\.io/rossoctl/cortex/[a-z-]+:[^"]+' operator/internal/webhook/config/defaults.go)
          if [ "$fail" -ne 0 ]; then
            echo "::error::pin the flagged AuthBridge injection image(s) to a cortex release tag (rossoctl/rossoctl#508)"
            exit 1
          fi
          echo "AuthBridge injection images are version-pinned OK (values.yaml + config/defaults.go)"

  # ============================================================================
  # Phase B: Container/IaC Security
  # ============================================================================

  hadolint:
    name: Dockerfile Lint (Hadolint)
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Find Dockerfiles
        id: find-dockerfiles
        run: |
          DOCKERFILES=$(find . -name "Dockerfile*" -type f 2>/dev/null | grep -v ".git/" || true)
          if [ -z "$DOCKERFILES" ]; then
            echo "has_dockerfiles=false" >> "$GITHUB_OUTPUT"
          else
            echo "Found Dockerfiles:"
            echo "$DOCKERFILES"
            echo "has_dockerfiles=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run Hadolint
        if: steps.find-dockerfiles.outputs.has_dockerfiles == 'true'
        uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387  # v3.5.0
        with:
          dockerfile: "**/Dockerfile*"
          recursive: true
          failure-threshold: error
          # DL3007: Using latest tag, DL3008: Unpinned apt packages
          # DL3015: No --no-install-recommends, DL3059: Multiple consecutive RUN
          ignore: DL3007,DL3008,DL3015,DL3059

  trivy-fs:
    name: Trivy Filesystem Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Dependency vulnerability scan (informational)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          severity: 'CRITICAL,HIGH'
          exit-code: '0'
          ignore-unfixed: true
          format: 'table'

      - name: IaC config scan (informational)
        # Informational until pre-existing K8s security issues are addressed
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
        with:
          scan-type: 'config'
          scan-ref: '.'
          severity: 'CRITICAL,HIGH,MEDIUM'
          skip-dirs: 'operator/demos'
          exit-code: '0'
          format: 'table'

  # ============================================================================
  # Phase C: Advanced Security
  # ============================================================================

  codeql:
    name: CodeQL Analysis (Go)
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Initialize CodeQL
        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4
        with:
          languages: go
          queries: security-extended

      - name: Autobuild
        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4
        with:
          category: "/language:go"

  action-pinning:
    name: Verify Action Pinning
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1

      - name: Check for unpinned GitHub Actions
        run: |
          echo "=== Checking for unpinned GitHub Actions ==="
          UNPINNED=$(grep -rh 'uses:' .github/workflows/ | grep -E 'uses:.*@' | grep -vE '@[0-9a-f]{40}' | sort -u || true)
          if [ -n "$UNPINNED" ]; then
            echo "::warning::Found actions not pinned to SHA commits:"
            echo "$UNPINNED"
            COUNT=$(echo "$UNPINNED" | wc -l | tr -d ' ')
            echo "Total unpinned actions: $COUNT"
            echo "NOTE: This check is informational."
          else
            echo "All actions are pinned to SHA commits!"
          fi
          exit 0