release-security-report.yml

name: Release Security Report

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      tag:
        description: 'Existing git tag to generate a security report for (e.g., v1.2.3)'
        required: true
        type: string

permissions:
  contents: write

concurrency:
  group: release-security-${{ github.event.release.id || github.run_id }}
  cancel-in-progress: false

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1
  RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }}

jobs:
  security-report:
    if: ${{ github.event_name == 'release' || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Checkout workflow sources
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: ${{ github.event.repository.default_branch }}

      - name: Checkout release tag
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          ref: refs/tags/${{ env.RELEASE_TAG }}
          path: release-src

      - name: Validate manual tag input
        if: ${{ github.event_name == 'workflow_dispatch' }}
        shell: pwsh
        run: |
          $tag = "${{ inputs.tag }}"
          if ([string]::IsNullOrWhiteSpace($tag)) {
            throw "Input 'tag' is required for manual runs."
          }

          git -C release-src describe --tags --exact-match "HEAD" | Out-Null
          if ($LASTEXITCODE -ne 0) {
            throw "Tag '$tag' does not match HEAD in release-src checkout."
          }

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install --no-install-recommends -y pkg-config libasound2-dev

      - name: Install stable Rust toolchain
        uses: dtolnay/rust-toolchain@stable

      - name: Cache cargo
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit (best effort)
        shell: bash
        run: |
          if ! command -v cargo-audit &> /dev/null; then
            if ! cargo install cargo-audit --locked; then
              echo "::warning::cargo-audit installation failed. dependency_audit will be reported as warning by the report generator."
            fi
          fi

      - name: Generate structured security report
        id: security_report
        shell: pwsh
        run: |
          $releaseRoot = (Resolve-Path "release-src").Path
          $outputDir = Join-Path $PWD "dist/security-reports"
          ./scripts/generate-security-report.ps1 `
            -Tag "$env:RELEASE_TAG" `
            -OutputDir $outputDir `
            -RepoRoot $releaseRoot

      - name: Upload report as workflow artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: security-report-${{ env.RELEASE_TAG }}
          path: dist/security-reports/*
          if-no-files-found: error

      - name: Upload report to release assets
        if: always()
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ env.RELEASE_TAG }}
          fail_on_unmatched_files: true
          files: |
            dist/security-reports/chatify-security-report-*.json
            dist/security-reports/chatify-security-report-*.md
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Enforce required security checks
        if: always()
        shell: pwsh
        run: |
          $report = Get-ChildItem -Path dist/security-reports -Filter "chatify-security-report-*.json" |
            Sort-Object LastWriteTime -Descending |
            Select-Object -First 1
          if (-not $report) {
            throw "Security report JSON not found in dist/security-reports"
          }

          $data = Get-Content -Path $report.FullName -Raw | ConvertFrom-Json
          if ($data.summary.overall_status -ne "pass") {
            throw "Required security checks failed for tag '$env:RELEASE_TAG'. See attached security report."
          }