security-scan.yml

name: Security Scan

on:
  push:
  pull_request:

permissions:
  contents: read
  security-events: write

jobs:
  ###############################################
  # 1. Run GITLEAKS (strong secret scanner)
  ###############################################
  gitleaks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Install Gitleaks
        run: |
          wget https://github.com/gitleaks/gitleaks/releases/download/v8.30.0/gitleaks_8.30.0_linux_x64.tar.gz
          tar -xzf gitleaks_8.30.0_linux_x64.tar.gz
          sudo mv gitleaks /usr/local/bin/
          gitleaks version

      - name: Run Gitleaks with baseline
        run: gitleaks detect --source . --verbose --redact --baseline-path gitleaks-baseline.json

  ###############################################
  # 2. Run Semgrep (SAST with PHP, JS, TS, Go, HTML support)
  ###############################################
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep

    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep scan
        run: semgrep scan --config auto --sarif --output semgrep-results.sarif
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload Semgrep results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep-results.sarif