MeshChatX/.github/workflows/security.yml

# Dependency audits, filesystem/container config scans, and CodeQL analysis.
#
# Pinned first-party actions (bump tag and SHA together when upgrading):
#   actions/checkout@v6.0.1                       8e8c483db84b4bee98b60c0593521ed34d9990e8
#   actions/download-artifact@v5.0.0              634f93cb2916e3fdff6788551b99b062d0335ce0
#   github/codeql-action/init@v4.31.6             95e58e9a2cdfd71adc6e0353d5c52f41a045d225
#   github/codeql-action/analyze@v4.31.6          95e58e9a2cdfd71adc6e0353d5c52f41a045d225

name: Security

on:
    push:
        branches:
            - master
            - dev
    pull_request:
        branches:
            - master
            - dev
    schedule:
        - cron: "30 12 * * 1"
        - cron: "35 18 * * 3"
    workflow_dispatch:

permissions:
    contents: read

concurrency:
    group: security-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
    cancel-in-progress: true

env:
    FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
    NODE_OPTIONS: --max-old-space-size=8192
    PYTHON_VERSION: "3.14"
    NODE_VERSION: "24"
    UV_VERSION: "0.11.15"
    PNPM_VERSION: "11.1.2"
    TRIVY_VERSION: "0.69.3"

jobs:
    dependency-audit:
        name: Dependency and config scan
        runs-on: ubuntu-latest
        timeout-minutes: 45
        permissions:
            contents: read
        steps:
            - name: Checkout
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: pip-audit
              run: |
                  uv run pip install --upgrade "pip>=26.1" pip-audit
                  uv run pip-audit

            - name: Apt update (for Trivy .deb)
              run: sh scripts/ci/exec-priv.sh apt-get update -qq

            - name: Setup Trivy
              run: sh scripts/ci/setup-trivy.sh

            - name: Trivy filesystem scan (dependencies)
              run: sh scripts/ci/trivy-fs-scan.sh

            - name: Trivy Dockerfile misconfiguration
              run: |
                  set -euo pipefail
                  for f in Dockerfile Dockerfile.hardened; do
                    trivy config --exit-code 1 "$f"
                  done

    frontend:
        name: Build frontend artifact (CodeQL)
        uses: ./.github/workflows/frontend-build.yml
        permissions:
            contents: read
        with:
            artifact_name: meshchatx-frontend-codeql-${{ github.run_id }}-${{ github.run_attempt }}
            retention_days: 1

    codeql:
        name: CodeQL (${{ matrix.language }})
        runs-on: ubuntu-latest
        timeout-minutes: 360
        permissions:
            security-events: write
            packages: read
            actions: read
            contents: read
        strategy:
            fail-fast: false
            matrix:
                include:
                    - language: actions
                      build-mode: none
                    - language: go
                      build-mode: autobuild
                    - language: java-kotlin
                      build-mode: none
                    - language: python
                      build-mode: none
        steps:
            - name: Checkout repository
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Initialize CodeQL
              uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
              with:
                  languages: ${{ matrix.language }}
                  build-mode: ${{ matrix.build-mode }}

            - name: Perform CodeQL Analysis
              uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
              with:
                  category: "/language:${{matrix.language}}"

    codeql-javascript:
        name: CodeQL (javascript-typescript)
        runs-on: ubuntu-latest
        needs: [frontend]
        timeout-minutes: 360
        permissions:
            security-events: write
            packages: read
            actions: read
            contents: read
        env:
            MESHCHATX_FRONTEND_PREBUILT: "1"
            FRONTEND_ARTIFACT_NAME: ${{ needs.frontend.outputs.artifact_name }}
        steps:
            - name: Checkout repository
              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8

            - name: Set up development environment
              uses: ./.github/actions/setup-dev-environment
              with:
                  python-version: ${{ env.PYTHON_VERSION }}
                  uv-version: ${{ env.UV_VERSION }}
                  node-version: ${{ env.NODE_VERSION }}
                  pnpm-version: ${{ env.PNPM_VERSION }}

            - name: Fetch frontend artifact
              uses: ./.github/actions/fetch-frontend-artifact
              with:
                  artifact-name: ${{ env.FRONTEND_ARTIFACT_NAME }}

            - name: Initialize CodeQL
              uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
              with:
                  languages: javascript-typescript
                  build-mode: none

            - name: Perform CodeQL Analysis
              uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
              with:
                  category: "/language:javascript-typescript"