security-scan.yml

# ============================================================================
# Advanced Security Scanning Workflow
# Combines SAST + SCA + Secret Detection + Malware Scanning
# Detects: CWEs, CVEs, Secrets, Malware, Vulnerabilities
# ============================================================================

name: "🔒 Advanced Security Scanning"

on:
  push:
    branches: [ "main", "master", "develop" ]
  pull_request:
    branches: [ "main", "master" ]
  schedule:
    - cron: '27 9 * * 0'  # Weekly scan on Sunday
  workflow_dispatch:  # Manual trigger

permissions:
  actions: read
  contents: read
  security-events: write
  pull-requests: write
  issues: write

jobs:
  # ============================================================================
  # JOB 1: CodeQL SAST Analysis (CWE Detection)
  # Detects: Code vulnerabilities, CWEs, security issues
  # ============================================================================
  codeql-sast:
    name: "🔍 CodeQL SAST - ${{ matrix.language }}"
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    timeout-minutes: 360
    
    permissions:
      security-events: write
      packages: read
      actions: read
      contents: read

    strategy:
      fail-fast: false
      matrix:
        include:
        - language: csharp
          build-mode: manual
          setup-required: true
        - language: java-kotlin
          build-mode: manual
          setup-required: true
        - language: javascript-typescript
          build-mode: none
          setup-required: false
        - language: python
          build-mode: none
          setup-required: false

    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for better analysis

    # ========================================
    # Setup for C# (.NET)
    # ========================================
    - name: ⚙️ Setup .NET SDK
      if: matrix.language == 'csharp'
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: |
          6.0.x
          7.0.x
          8.0.x
        
    # ========================================
    # Setup for Java/Kotlin
    # ========================================
    - name: ⚙️ Setup Java JDK
      if: matrix.language == 'java-kotlin'
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '17'
        cache: 'maven'

    # ========================================
    # Setup for Python
    # ========================================
    - name: ⚙️ Setup Python
      if: matrix.language == 'python'
      uses: actions/setup-python@v5
      with:
        python-version: '3.11'
        cache: 'pip'

    # ========================================
    # Setup for JavaScript/TypeScript
    # ========================================
    - name: ⚙️ Setup Node.js
      if: matrix.language == 'javascript-typescript'
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'

    # ========================================
    # Initialize CodeQL with Enhanced Queries
    # ========================================
    - name: 🔧 Initialize CodeQL
      uses: github/codeql-action/init@v3
      with:
        languages: ${{ matrix.language }}
        build-mode: ${{ matrix.build-mode }}
        # Enhanced security queries for comprehensive CWE detection
        queries: +security-extended,security-and-quality
        config: |
          name: "Advanced Security Configuration"
          
          # Exclude non-production code
          paths-ignore:
            - '**/test/**'
            - '**/tests/**'
            - '**/Test/**'
            - '**/Tests/**'
            - '**/*.test.js'
            - '**/*.spec.js'
            - '**/*.test.ts'
            - '**/*.spec.ts'
            - '**/obj/**'
            - '**/bin/**'
            - '**/node_modules/**'
            - '**/vendor/**'
            - '**/*.Designer.cs'
            - '**/*.designer.cs'
            - '**/*.generated.cs'
            - '**/*.g.cs'
            - '**/Migrations/**'
          
          # Focus on source code
          paths:
            - 'src/**'
            - 'app/**'
            - 'lib/**'
            - 'core/**'
          
          # Query filters for high-quality results
          query-filters:
            - include:
                kind: problem
                problem.severity: 
                  - error
                  - warning
            - include:
                tags contain: security
            - include:
                tags contain: external/cwe
          
          # Enable advanced features
          trap-caching: true

    # ========================================
    # Manual Build for C#
    # ========================================
    - name: 🔨 Build C# Project
      if: matrix.language == 'csharp' && matrix.build-mode == 'manual'
      run: |
        echo "🔍 Discovering .NET projects..."
        find . -name "*.sln" -o -name "*.csproj" | head -10
        
        echo "📦 Restoring NuGet packages..."
        dotnet restore --verbosity minimal
        
        echo "🏗️ Building projects in Release mode..."
        dotnet build --configuration Release --no-restore --verbosity minimal /p:UseSharedCompilation=false /p:TreatWarningsAsErrors=false
        
        echo "✅ Build completed successfully"

    # ========================================
    # Manual Build for Java/Kotlin
    # ========================================
    - name: 🔨 Build Java/Kotlin Project
      if: matrix.language == 'java-kotlin' && matrix.build-mode == 'manual'
      run: |
        echo "🔍 Detecting build system..."
        
        if [ -f "pom.xml" ]; then
          echo "📦 Maven project detected"
          mvn clean install -DskipTests -B -V
        elif [ -f "build.gradle" ] || [ -f "build.gradle.kts" ]; then
          echo "📦 Gradle project detected"
          ./gradlew build -x test --no-daemon
        else
          echo "⚠️ No recognized build file found"
        fi
        
        echo "✅ Build completed successfully"

    # ========================================
    # Perform CodeQL Analysis
    # ========================================
    - name: 🔬 Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v3
      with:
        category: "/language:${{ matrix.language }}"
        output: sarif-results
        upload: true
        # Add detailed output
        add-snippets: true

    # ========================================
    # Upload SARIF Results
    # ========================================
    - name: 📤 Upload CodeQL SARIF Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: codeql-sarif-${{ matrix.language }}
        path: sarif-results
        retention-days: 30

  # ============================================================================
  # JOB 2: Dependency Scanning - SCA (CVE Detection)
  # Detects: Known vulnerabilities in dependencies (CVEs)
  # ============================================================================
  dependency-sca:
    name: "📦 SCA - Dependency & CVE Scanning"
    runs-on: ubuntu-latest
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    # ========================================
    # .NET Dependency Scanning
    # ========================================
    - name: ⚙️ Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '8.0.x'

    - name: 🔍 Scan .NET Dependencies for CVEs
      continue-on-error: true
      run: |
        echo "🔍 Scanning .NET dependencies for known vulnerabilities..."
        
        # Check for vulnerable packages
        dotnet list package --vulnerable --include-transitive 2>&1 | tee dotnet-vulnerabilities.txt
        
        # Generate detailed report
        echo "## 📊 .NET Dependency Vulnerability Report" > dependency-report.md
        echo "" >> dependency-report.md
        
        if grep -q "has the following vulnerable packages" dotnet-vulnerabilities.txt; then
          echo "⚠️ **VULNERABILITIES FOUND**" >> dependency-report.md
          echo "" >> dependency-report.md
          cat dotnet-vulnerabilities.txt >> dependency-report.md
          echo "::warning::Vulnerable .NET dependencies detected!"
        else
          echo "✅ No known vulnerabilities found in .NET dependencies" >> dependency-report.md
        fi

    # ========================================
    # Generate SBOM (Software Bill of Materials)
    # ========================================
    - name: 📋 Generate SBOM
      continue-on-error: true
      run: |
        echo "📋 Generating Software Bill of Materials..."
        
        # Install CycloneDX for .NET
        dotnet tool install --global CycloneDX
        
        # Generate SBOM in multiple formats
        dotnet CycloneDX . -o . -f sbom.json -t
        dotnet CycloneDX . -o . -f sbom.xml -t
        
        echo "✅ SBOM generated successfully"

    - name: 📤 Upload SBOM
      uses: actions/upload-artifact@v4
      with:
        name: sbom-reports
        path: |
          sbom.json
          sbom.xml
        retention-days: 90

    # ========================================
    # NPM Dependency Scanning (if applicable)
    # ========================================
    - name: 🔍 Scan NPM Dependencies
      if: hashFiles('**/package.json') != ''
      continue-on-error: true
      run: |
        echo "🔍 Scanning NPM dependencies..."
        
        if [ -f "package.json" ]; then
          npm audit --json > npm-audit.json || true
          npm audit --audit-level=moderate || echo "::warning::NPM vulnerabilities detected"
        fi

    # ========================================
    # Python Dependency Scanning (if applicable)
    # ========================================
    - name: 🔍 Scan Python Dependencies
      if: hashFiles('**/requirements.txt', '**/Pipfile', '**/pyproject.toml') != ''
      continue-on-error: true
      run: |
        echo "🔍 Scanning Python dependencies..."
        
        pip install safety
        
        if [ -f "requirements.txt" ]; then
          safety check --file requirements.txt --json > python-safety.json || true
          safety check --file requirements.txt || echo "::warning::Python vulnerabilities detected"
        fi

    # ========================================
    # Dependency Review (for Pull Requests)
    # ========================================
    - name: 🔍 Dependency Review
      if: github.event_name == 'pull_request'
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: moderate
        deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0
        comment-summary-in-pr: always

    # ========================================
    # Upload Dependency Reports
    # ========================================
    - name: 📤 Upload Dependency Reports
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: dependency-scan-reports
        path: |
          dotnet-vulnerabilities.txt
          dependency-report.md
          npm-audit.json
          python-safety.json
        retention-days: 30

  # ============================================================================
  # JOB 3: Secret Scanning
  # Detects: API keys, passwords, tokens, credentials
  # ============================================================================
  secret-detection:
    name: "🔐 Secret & Credential Detection"
    runs-on: ubuntu-latest
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for comprehensive scanning

    # ========================================
    # Gitleaks - Secret Detection
    # ========================================
    - name: 🔍 Gitleaks Secret Scan
      uses: gitleaks/gitleaks-action@v2
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    # ========================================
    # TruffleHog - Advanced Secret Detection
    # ========================================
    - name: 🔍 TruffleHog Secret Scan
      continue-on-error: true
      run: |
        echo "🔍 Running TruffleHog secret scanner..."
        
        # Install TruffleHog
        docker pull trufflesecurity/trufflehog:latest
        
        # Scan repository
        docker run --rm -v "$PWD:/scan" trufflesecurity/trufflehog:latest \
          filesystem /scan \
          --json \
          --no-update \
          > trufflehog-results.json || true
        
        # Check results
        if [ -s trufflehog-results.json ]; then
          echo "::warning::Potential secrets detected by TruffleHog"
          cat trufflehog-results.json
        fi

    # ========================================
    # Detect-Secrets - Additional Layer
    # ========================================
    - name: 🔍 Detect-Secrets Scan
      continue-on-error: true
      run: |
        echo "🔍 Running detect-secrets scanner..."
        
        pip install detect-secrets
        
        # Create baseline
        detect-secrets scan --all-files --force-use-all-plugins > .secrets.baseline
        
        # Audit results
        detect-secrets audit .secrets.baseline || echo "::warning::Potential secrets detected"

    - name: 📤 Upload Secret Scan Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: secret-scan-results
        path: |
          trufflehog-results.json
          .secrets.baseline
        retention-days: 30

  # ============================================================================
  # JOB 4: Malware & Virus Scanning
  # Detects: Malware, viruses, trojans, suspicious code
  # ============================================================================
  malware-scan:
    name: "🦠 Malware & Virus Detection"
    runs-on: ubuntu-latest
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    # ========================================
    # ClamAV Antivirus Scan
    # ========================================
    - name: 🦠 ClamAV Malware Scan
      continue-on-error: true
      run: |
        echo "🦠 Installing ClamAV..."
        sudo apt-get update
        sudo apt-get install -y clamav clamav-daemon
        
        echo "📥 Updating virus definitions..."
        sudo systemctl stop clamav-freshclam
        sudo freshclam
        
        echo "🔍 Scanning repository for malware..."
        clamscan -r --bell -i . | tee clamav-scan.txt
        
        if grep -q "Infected files: 0" clamav-scan.txt; then
          echo "✅ No malware detected"
        else
          echo "::error::Malware detected in repository!"
          exit 1
        fi

    # ========================================
    # YARA Rules Scan (Advanced Pattern Matching)
    # ========================================
    - name: 🔍 YARA Pattern Scan
      continue-on-error: true
      run: |
        echo "🔍 Installing YARA..."
        sudo apt-get install -y yara
        
        # Create basic YARA rules for suspicious patterns
        cat > suspicious.yar << 'EOF'
        rule SuspiciousBase64
        {
            strings:
                $base64 = /[A-Za-z0-9+\/]{40,}={0,2}/ nocase
            condition:
                $base64
        }
        
        rule SuspiciousEval
        {
            strings:
                $eval1 = "eval(" nocase
                $eval2 = "exec(" nocase
                $eval3 = "system(" nocase
            condition:
                any of them
        }
        
        rule ObfuscatedCode
        {
            strings:
                $obf1 = /\\x[0-9a-f]{2}/i
                $obf2 = /\\u[0-9a-f]{4}/i
            condition:
                any of them
        }
        EOF
        
        echo "🔍 Scanning for suspicious patterns..."
        yara -r suspicious.yar . | tee yara-results.txt || true

    - name: 📤 Upload Malware Scan Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: malware-scan-results
        path: |
          clamav-scan.txt
          yara-results.txt
        retention-days: 30

  # ============================================================================
  # JOB 5: Additional SAST Tools
  # Enhanced static analysis with multiple tools
  # ============================================================================
  additional-sast:
    name: "🔬 Additional SAST Analysis"
    runs-on: ubuntu-latest
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    # ========================================
    # Semgrep - Fast SAST
    # ========================================
    - name: 🔍 Semgrep SAST Scan
      uses: returntocorp/semgrep-action@v1
      with:
        config: >-
          p/security-audit
          p/secrets
          p/owasp-top-ten
          p/cwe-top-25
          p/r2c-security-audit
          p/sql-injection
          p/xss
          p/command-injection
        generateSarif: true

    # ========================================
    # Snyk - Security & License Scanning
    # ========================================
    - name: 🔍 Snyk Security Scan
      uses: snyk/actions/dotnet@master
      continue-on-error: true
      env:
        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
      with:
        args: --all-projects --severity-threshold=medium --sarif-file-output=snyk.sarif

    - name: 📤 Upload Snyk SARIF
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: snyk.sarif

    # ========================================
    # Bandit - Python Security Linter
    # ========================================
    - name: 🔍 Bandit Python Security Scan
      if: hashFiles('**/*.py') != ''
      continue-on-error: true
      run: |
        echo "🔍 Running Bandit Python security scanner..."
        pip install bandit
        bandit -r . -f json -o bandit-results.json || true
        bandit -r . || echo "::warning::Python security issues detected"

    # ========================================
    # ESLint Security Plugin (JavaScript/TypeScript)
    # ========================================
    - name: 🔍 ESLint Security Scan
      if: hashFiles('**/*.js', '**/*.ts') != ''
      continue-on-error: true
      run: |
        if [ -f "package.json" ]; then
          echo "🔍 Running ESLint security scanner..."
          npm install -g eslint eslint-plugin-security
          eslint . --ext .js,.ts --format json > eslint-results.json || true
        fi

    - name: 📤 Upload SAST Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: additional-sast-results
        path: |
          bandit-results.json
          eslint-results.json
        retention-days: 30

  # ============================================================================
  # JOB 6: Container Security (if Docker is used)
  # ============================================================================
  container-security:
    name: "🐳 Container Security Scan"
    runs-on: ubuntu-latest
    if: hashFiles('**/Dockerfile', '**/docker-compose.yml') != ''
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    # ========================================
    # Trivy - Container Vulnerability Scanner
    # ========================================
    - name: 🔍 Trivy Filesystem Scan
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL,HIGH,MEDIUM'
        vuln-type: 'os,library'

    - name: 📤 Upload Trivy SARIF
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-results.sarif'

    # ========================================
    # Hadolint - Dockerfile Linter
    # ========================================
    - name: 🔍 Hadolint Dockerfile Scan
      uses: hadolint/hadolint-action@v3.1.0
      with:
        dockerfile: Dockerfile
        format: sarif
        output-file: hadolint-results.sarif
        no-fail: true

    - name: 📤 Upload Hadolint SARIF
      uses: github/codeql-action/upload-sarif@v3
      if: always()
      with:
        sarif_file: hadolint-results.sarif

  # ============================================================================
  # JOB 7: License Compliance Check
  # ============================================================================
  license-compliance:
    name: "⚖️ License Compliance Check"
    runs-on: ubuntu-latest
    
    steps:
    - name: 📥 Checkout repository
      uses: actions/checkout@v4

    - name: ⚙️ Setup .NET
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '8.0.x'

    - name: 🔍 License Compliance Scan
      continue-on-error: true
      run: |
        echo "🔍 Scanning for license compliance..."
        
        # Install license checker
        dotnet tool install --global dotnet-project-licenses
        
        # Generate license report
        dotnet-project-licenses --input . --output-directory licenses --export-license-texts
        
        echo "✅ License report generated"

    - name: 📤 Upload License Report
      uses: actions/upload-artifact@v4
      with:
        name: license-compliance-report
        path: licenses/
        retention-days: 90

  # ============================================================================
  # JOB 8: Security Summary Report
  # Consolidates all scan results
  # ============================================================================
  security-summary:
    name: "📊 Security Summary Report"
    runs-on: ubuntu-latest
    needs: [codeql-sast, dependency-sca, secret-detection, malware-scan, additional-sast]
    if: always()
    
    steps:
    - name: 📊 Generate Security Summary
      run: |
        echo "# 🔒 Comprehensive Security Scan Report" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "## 📋 Scan Results Overview" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "| Security Check | Status |" >> $GITHUB_STEP_SUMMARY
        echo "|---------------|--------|" >> $GITHUB_STEP_SUMMARY
        echo "| 🔍 CodeQL SAST (CWE Detection) | ${{ needs.codeql-sast.result }} |" >> $GITHUB_STEP_SUMMARY
        echo "| 📦 Dependency SCA (CVE Detection) | ${{ needs.dependency-sca.result }} |" >> $GITHUB_STEP_SUMMARY
        echo "| 🔐 Secret Detection | ${{ needs.secret-detection.result }} |" >> $GITHUB_STEP_SUMMARY
        echo "| 🦠 Malware Scan | ${{ needs.malware-scan.result }} |" >> $GITHUB_STEP_SUMMARY
        echo "| 🔬 Additional SAST | ${{ needs.additional-sast.result }} |" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "## 🎯 What Was Scanned" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "✅ **CWE Detection** - Common Weakness Enumeration (code vulnerabilities)" >> $GITHUB_STEP_SUMMARY
        echo "✅ **CVE Detection** - Known vulnerabilities in dependencies" >> $GITHUB_STEP_SUMMARY
        echo "✅ **Secret Detection** - API keys, passwords, tokens" >> $GITHUB_STEP_SUMMARY
        echo "✅ **Malware Detection** - Viruses, trojans, suspicious code" >> $GITHUB_STEP_SUMMARY
        echo "✅ **SAST Analysis** - Static code security analysis" >> $GITHUB_STEP_SUMMARY
        echo "✅ **SCA Analysis** - Software composition analysis" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "## 📊 Detailed Reports" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "View detailed results in:" >> $GITHUB_STEP_SUMMARY
        echo "- 🔒 **Security tab** - CodeQL findings" >> $GITHUB_STEP_SUMMARY
        echo "- 📦 **Artifacts** - Detailed scan reports" >> $GITHUB_STEP_SUMMARY
        echo "- 🔍 **Actions logs** - Full scan output" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "---" >> $GITHUB_STEP_SUMMARY
        echo "🔒 **Security Scan Completed** - $(date)" >> $GITHUB_STEP_SUMMARY

    # ========================================
    # Create GitHub Issue for Critical Findings
    # ========================================
    - name: 🚨 Create Security Issue (if failures)
      if: |
        needs.codeql-sast.result == 'failure' ||
        needs.dependency-sca.result == 'failure' ||
        needs.secret-detection.result == 'failure' ||
        needs.malware-scan.result == 'failure'
      uses: actions/github-script@v7
      with:
        script: |
          github.rest.issues.create({
            owner: context.repo.owner,
            repo: context.repo.repo,
            title: '🚨 Security Scan Detected Critical Issues',
            body: `## 🔒 Security Scan Alert
            
            Critical security issues were detected in the latest scan.
            
            **Workflow Run:** ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
            
            **Failed Checks:**
            - CodeQL SAST: ${{ needs.codeql-sast.result }}
            - Dependency SCA: ${{ needs.dependency-sca.result }}
            - Secret Detection: ${{ needs.secret-detection.result }}
            - Malware Scan: ${{ needs.malware-scan.result }}
            
            Please review the Security tab and workflow artifacts for detailed findings.
            
            **Action Required:** Address these security issues before merging.`,
            labels: ['security', 'critical', 'automated']
          })