security-scan.yml

name: Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]
  schedule:
    # Run weekly on Monday at 00:00
    - cron: '0 0 * * 1'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v3
    
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'
    
    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install bandit safety pip-audit
    
    - name: Run Bandit security linter
      run: |
        bandit -r . -f json -o bandit-report.json || true
        bandit -r . -f txt
      continue-on-error: true
    
    - name: Run Safety dependency check
      run: |
        safety check --json --output safety-report.json || true
        safety check
      continue-on-error: true
    
    - name: Run pip-audit
      run: |
        pip-audit --format json --output pip-audit-report.json || true
        pip-audit
      continue-on-error: true
    
    - name: Upload security reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: security-reports
        path: |
          bandit-report.json
          safety-report.json
          pip-audit-report.json
    
    - name: Run security tests
      run: |
        pytest tests/test_security.py -v --cov=utils --cov-report=html --cov-report=term
    
    - name: Upload coverage report
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: coverage-report
        path: htmlcov/