core/.github/workflows/security-pipeline.yml at 6f2e0ab0388f267b01e2b362b8b7dfd60a4b5735 · psfs/core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
name: Security Pipeline

on:
  pull_request:
  push:
    branches:
      - master
      - main

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  security-core-gates:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup PHP 8.3 (no Docker)
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          coverage: none
          tools: composer:v2
          extensions: curl, gmp

      - name: Install dependencies
        env:
          COMPOSER_MEMORY_LIMIT: -1
        run: composer install --no-interaction --prefer-dist --no-progress

      - name: Run must-pass security tests
        run: |
          php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenPrecedenceHeaderCookieAndQuery$/'
          php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*AuthApiTest::testResolveApiTokenRejectsMalformedHeaderTokenAndFallsBackToCookie$/'
          php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCookiePayloadMatrixAndSecurityInterplay$/'
          php vendor/bin/phpunit --colors=never --no-coverage --do-not-fail-on-warning --do-not-fail-on-risky --filter '/^.*RequestResponseSecurityContractTest::testCheckCorsSetsHeadersForAllowedOriginOnGet$/'

      - name: Run dependency audit (SCA)
        env:
          COMPOSER_MEMORY_LIMIT: -1
        run: composer audit --no-interaction

      - name: Enforce hardening gate (P2)
        env:
          PSFS_SECURITY_STRICT: '1'
        run: php scripts/security/hardening_gate.php

      - name: Enforce quality gate
        run: php scripts/security/quality_gate.php

      - name: Upload quality gate report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-quality-gate
          path: security/reports/quality-gate.json
          if-no-files-found: ignore

      - name: Upload hardening gate report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-hardening-gate
          path: security/reports/hardening-gate.json
          if-no-files-found: ignore

  security-static-analysis:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Semgrep (SAST)
        run: |
          mkdir -p security/reports
          docker run --rm -v "$PWD":/src semgrep/semgrep:latest \
            semgrep --config p/owasp-top-ten --error \
            --exclude-rule=generic.nginx.security.request-host-used.request-host-used \
            --sarif --output /src/security/reports/semgrep.sarif /src

      - name: Run Gitleaks (secret scanning)
        run: |
          mkdir -p security/reports
          docker run --rm -v "$PWD":/repo zricethezav/gitleaks:latest \
            detect --source /repo --no-git --redact --config /repo/.gitleaks.toml \
            --report-format json --report-path /repo/security/reports/gitleaks-report.json

      - name: Upload Gitleaks report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-gitleaks
          path: security/reports/gitleaks-report.json
          if-no-files-found: ignore

      - name: Generate SBOM (CycloneDX)
        run: |
          mkdir -p security/reports
          docker run --rm -v "$PWD":/repo anchore/syft:latest \
            /repo -o cyclonedx-json=/repo/security/reports/sbom.cyclonedx.json

      - name: Upload Semgrep SARIF
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-semgrep
          path: security/reports/semgrep.sarif
          if-no-files-found: ignore

      - name: Upload SBOM
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-sbom
          path: security/reports/sbom.cyclonedx.json
          if-no-files-found: ignore