security.yml

name: Security

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: '30 2 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Analyze
        uses: github/codeql-action/analyze@v4
        with:
          category: /language:${{ matrix.language }}

  dependency-review:
    name: Dependency review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      # Requires the repository's "Dependency graph" setting to be enabled
      # (Settings → Code security and analysis). Until that is flipped, the
      # action exits with "Dependency review is not supported on this
      # repository"; the step is advisory so CI stays green, and becomes a
      # blocking gate as soon as the setting is enabled.
      - name: Review dependency changes
        continue-on-error: true
        uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: high
          fail-on-scopes: runtime, development
          # Residual-risk advisories accepted for the current Next.js 14.x
          # toolchain (see SECURITY.md → "Dependency audit status"). They only
          # clear with the Next.js 16 major upgrade; allow-listing them keeps
          # this gate strict (any *new* advisory still fails the check).
          allow-ghsas: |
            GHSA-9g9p-9gw9-jx7f
            GHSA-h25m-26qc-wcjf
            GHSA-ggv3-7p47-pfv8
            GHSA-3x4c-7xq6-9pq8
            GHSA-q4gf-8mx6-v5v3
            GHSA-8h8q-6873-q5fj
            GHSA-3g8h-86w9-wvmq
            GHSA-ffhc-5mcf-pf4q
            GHSA-vfv6-92ff-j949
            GHSA-gx5p-jg67-6x7h
            GHSA-h64f-5h5j-jqjh
            GHSA-c4j6-fc7j-m34r
            GHSA-wfc6-r584-vfw7
            GHSA-36qx-fr4f-26g5
            GHSA-m99w-x7hq-7vfj
            GHSA-89xv-2m56-2m9x
            GHSA-68g3-v927-f742
            GHSA-4633-3j49-mh5q
            GHSA-4c39-4ccg-62r3
            GHSA-p9j2-gv94-2wf4
            GHSA-955p-x3mx-jcvp
            GHSA-qx2v-qp2m-jg93
            GHSA-6g55-p6wh-862q
            GHSA-fxqj-rqcc-2cmp
            GHSA-r28c-9q8g-f849

  secret-scan:
    name: Secret scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout full history
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      # Runs the gitleaks CLI directly instead of gitleaks/gitleaks-action
      # because that action requires a (free) GITLEAKS_LICENSE secret for
      # organization-owned repositories. The pinned release binary keeps this
      # job self-contained; the SARIF report is uploaded to code scanning so
      # findings surface alongside CodeQL alerts.
      - name: Scan repository history for secrets
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz | tar -xz gitleaks
          ./gitleaks git --redact --no-banner --exit-code=1 \
            --report-format sarif --report-path gitleaks.sarif

      - name: Upload SARIF to code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: gitleaks.sarif

      - name: Upload SARIF artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: gitleaks-sarif
          path: gitleaks.sarif
          if-no-files-found: warn
          retention-days: 7