backend/.github/workflows/security.yml

name: Security

on:
  push:
    branches: ["**"]
  pull_request:
    branches: [main]
  schedule:
    - cron: "0 6 * * *"  # nightly scan of main

jobs:
  trivy:
    name: Container scan (Trivy)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/build-push-action@v6
        with:
          context: .
          tags: rmi:scan
          push: false
          load: true
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: rmi:scan
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

  semgrep:
    name: SAST (Semgrep)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/python
            p/sql-injection
            p/xss
            p/command-injection
            p/secrets

  gitleaks:
    name: Secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}