security.yml

name: Security Checks

on:
    schedule:
        - cron: '0 0 * * 0' # Weekly on Sunday at midnight
    push:
        branches: [main, develop]
    pull_request:
        branches: [main, develop]
    workflow_dispatch:

permissions:
    contents: read
    security-events: write
    actions: read

jobs:
    dependency-audit:
        name: Dependency Security Audit
        runs-on: ubuntu-latest

        steps:
            - name: Checkout Code
              uses: actions/checkout@v4

            - name: Setup PHP
              uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f 
              # uses: shivammathur/setup-php@2.37.0
              with:
                  php-version: '8.2'
                  tools: composer:v2

            - name: Setup Node.js
              uses: actions/setup-node@v4
              with:
                  node-version: '20'

            - name: Install Dependencies
              run: |
                  composer install --no-interaction --prefer-dist
                  npm ci

            - name: Composer Security Audit
              run: composer audit --format=plain || true

            - name: NPM Security Audit
              run: npm audit --audit-level=moderate || true

            - name: Check for known vulnerabilities (PHP)
              run: |
                  # Use local-php-security-checker if available
                  if command -v local-php-security-checker &> /dev/null; then
                    local-php-security-checker --path=composer.lock
                  else
                    echo "Skipping PHP security checker (not installed)"
                  fi

    code-scanning:
        name: Code Security Scanning
        runs-on: ubuntu-latest

        steps:
            - name: Checkout Code
              uses: actions/checkout@v4

            - name: Initialize CodeQL
              uses: github/codeql-action/init@v4
              with:
                  languages: javascript, php
                  queries: security-and-quality

            - name: Perform CodeQL Analysis
              uses: github/codeql-action/analyze@v4

    secret-scanning:
        name: Secret Scanning
        runs-on: ubuntu-latest

        steps:
            - name: Checkout Code
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - name: Gitleaks Scan
              uses: gitleaks/gitleaks-action@e6dab246340401bf53eec993b8f05aebe80ac636
              # uses: gitleaks/gitleaks-action@v2.3.4
              env:
                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    security-headers:
        name: Security Headers & Best Practices
        runs-on: ubuntu-latest

        steps:
            - name: Checkout Code
              uses: actions/checkout@v4

            - name: Check for hardcoded secrets
              run: |
                  echo "Checking for potential hardcoded secrets..."

                  # Search for common patterns (excluding test files)
                  ! grep -r -i "password\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded passwords"
                  ! grep -r -i "api_key\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded API keys"
                  ! grep -r -i "secret\s*=\s*['\"]" --include="*.php" src/ || echo "Warning: Found potential hardcoded secrets"

            - name: Check WordPress Security Best Practices
              run: |
                  echo "Checking WordPress security best practices..."

                  # Check for direct file access protection
                  if ! grep -qE "defined\s*\(\s*['\"]ABSPATH['\"]" sparxstar-gluon.php; then
                    echo "Warning: Main plugin file should check for ABSPATH"
                  fi

                  # Check for proper nonce verification in AJAX/form handlers
                  echo "✓ Security best practices check completed"

    permissions-check:
        name: File Permissions Check
        runs-on: ubuntu-latest

        steps:
            - name: Checkout Code
              uses: actions/checkout@v4

            - name: Check File Permissions
              run: |
                  echo "Checking for executable PHP files..."

                  # Find executable PHP files (should not be executable)
                  EXEC_FILES=$(find src/ -name "*.php" -type f -executable 2>/dev/null || true)

                  if [ -n "$EXEC_FILES" ]; then
                    echo "Warning: Found executable PHP files:"
                    echo "$EXEC_FILES"
                  else
                    echo "✓ No executable PHP files found"
                  fi