Security Checks #136
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Checks | |
| on: | |
| schedule: | |
| - cron: '0 0 * * 0' # Weekly on Sunday at midnight | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f | |
| # uses: shivammathur/setup-php@2.37.0 | |
| with: | |
| php-version: '8.2' | |
| tools: composer:v2 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| - name: Install Dependencies | |
| run: | | |
| composer install --no-interaction --prefer-dist | |
| npm ci | |
| - name: Composer Security Audit | |
| run: composer audit --format=plain || true | |
| - name: NPM Security Audit | |
| run: npm audit --audit-level=moderate || true | |
| - name: Check for known vulnerabilities (PHP) | |
| run: | | |
| # Use local-php-security-checker if available | |
| if command -v local-php-security-checker &> /dev/null; then | |
| local-php-security-checker --path=composer.lock | |
| else | |
| echo "Skipping PHP security checker (not installed)" | |
| fi | |
| code-scanning: | |
| name: Code Security Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: javascript, php | |
| queries: security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| secret-scanning: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Gitleaks Scan | |
| uses: gitleaks/gitleaks-action@e6dab246340401bf53eec993b8f05aebe80ac636 | |
| # uses: gitleaks/gitleaks-action@v2.3.4 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| security-headers: | |
| name: Security Headers & Best Practices | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Check for hardcoded secrets | |
| run: | | |
| echo "Checking for potential hardcoded secrets..." | |
| # Search for common patterns (excluding test files) | |
| ! grep -r -i "password\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded passwords" | |
| ! grep -r -i "api_key\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded API keys" | |
| ! grep -r -i "secret\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded secrets" | |
| - name: Check WordPress Security Best Practices | |
| run: | | |
| echo "Checking WordPress security best practices..." | |
| # Check for direct file access protection | |
| if ! grep -qE "defined\s*\(\s*['\"]ABSPATH['\"]" sparxstar-gluon.php; then | |
| echo "Warning: Main plugin file should check for ABSPATH" | |
| fi | |
| # Check for proper nonce verification in AJAX/form handlers | |
| echo "✓ Security best practices check completed" | |
| permissions-check: | |
| name: File Permissions Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Check File Permissions | |
| run: | | |
| echo "Checking for executable PHP files..." | |
| # Find executable PHP files (should not be executable) | |
| EXEC_FILES=$(find src/ -name "*.php" -type f -executable 2>/dev/null || true) | |
| if [ -n "$EXEC_FILES" ]; then | |
| echo "Warning: Found executable PHP files:" | |
| echo "$EXEC_FILES" | |
| else | |
| echo "✓ No executable PHP files found" | |
| fi |