Security #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # SpatialSync — Security Scanning Pipeline | |
| # 2026 Industry Standard: Integrated security at every stage | |
| # ============================================================================= | |
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '0 2 * * 1' | |
| workflow_call: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| env: | |
| PHP_VERSION: '8.3' | |
| NODE_VERSION: '22' | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # 1. CodeQL Security Analysis | |
| # --------------------------------------------------------------------------- | |
| codeql: | |
| name: 🛡️ CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: javascript | |
| queries: security-extended, security-and-quality | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: '/language:javascript-typescript' | |
| # --------------------------------------------------------------------------- | |
| # 2. PHP Security Audit | |
| # --------------------------------------------------------------------------- | |
| php-audit: | |
| name: 🔒 PHP Security Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: ${{ env.PHP_VERSION }} | |
| extensions: mbstring, bcmath, gd, zip, pdo_pgsql, pgsql | |
| tools: composer:v2 | |
| coverage: none | |
| - name: Create .env for CI | |
| run: cp .env.example .env | |
| - name: Install PHP dependencies (without scripts) | |
| run: composer install --no-interaction --prefer-dist --no-progress --no-scripts | |
| - name: Generate app key | |
| run: php -r "file_put_contents('.env', preg_replace('/^APP_KEY=.*/m', 'APP_KEY=base64:' . base64_encode(random_bytes(32)), file_get_contents('.env')));" | |
| - name: Run Composer Audit | |
| run: composer audit --ansi | |
| continue-on-error: true | |
| - name: Check for abandoned packages | |
| run: | | |
| if composer audit --ansi 2>&1 | grep -i "abandoned"; then | |
| echo "::warning::Abandoned packages found — see output above" | |
| else | |
| echo "✅ No abandoned packages detected via audit" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # 3. JavaScript Security Audit | |
| # --------------------------------------------------------------------------- | |
| npm-audit: | |
| name: 🔒 NPM Security Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install Node dependencies | |
| run: npm ci --no-audit --no-fund | |
| - name: Run NPM Audit | |
| run: | | |
| npm audit --audit-level=high || true | |
| echo "::warning::npm audit completed. Review any high/critical findings above." | |
| - name: Run NPM Audit for production deps only | |
| run: npm audit --production --audit-level=high | |
| continue-on-error: true | |
| # --------------------------------------------------------------------------- | |
| # 4. Secret Scanning (git leaks) | |
| # --------------------------------------------------------------------------- | |
| secrets: | |
| name: 🔑 Secret Scanning | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for secrets with trufflehog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| extra_args: --results=verified,unknown --no-verification | |
| continue-on-error: true | |
| - name: Basic secret pattern check | |
| run: | | |
| echo "🔍 Checking for potential secrets in code..." | |
| ISSUES=0 | |
| # Check for hardcoded API keys | |
| if grep -rnP '(?<![A-Za-z])[A-Za-z0-9_-]{32,}(?![A-Za-z])' --include="*.php" --include="*.js" app/ resources/ config/ routes/ 2>/dev/null | grep -v "base64:" | grep -v "tests/"; then | |
| ISSUES=$((ISSUES + 1)) | |
| fi | |
| # Check for common secret patterns | |
| for PATTERN in "password" "secret" "api_key" "apikey" "supabase_key"; do | |
| if grep -rn "$PATTERN" --include="*.php" --include="*.js" app/ resources/ config/ routes/ 2>/dev/null | grep -v "env(" | grep -v "config(" | grep -v "//\|/\*\|#\|<!--\|{{--"; then | |
| echo "::warning::Potential hardcoded $PATTERN found" | |
| ISSUES=$((ISSUES + 1)) | |
| fi | |
| done | |
| if [ $ISSUES -eq 0 ]; then | |
| echo "✅ No obvious secrets found in code" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # 5. GitHub Advisory Database Check | |
| # --------------------------------------------------------------------------- | |
| advisories: | |
| name: 📋 Advisory Check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Check GitHub advisories for dependencies | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| comment-summary-in-pr: true | |
| continue-on-error: true |