codeql.yml

name: CodeQL Security Analysis

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Run weekly on Sundays at 2 AM UTC
    - cron: '0 2 * * 0'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read
  deployments: read

env:
  NODE_VERSION: '20'

jobs:
  analyze:
    name: CodeQL Analysis
    runs-on: ubuntu-latest
    timeout-minutes: 60
    strategy:
      fail-fast: false
      matrix:
        language: ['javascript', 'typescript']
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended,security-and-quality
          config-file: .github/codeql-config.yml
          source-root: .

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Build project
        run: npm run build

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          category: "/language:${{ matrix.language }}"
          upload: true
          upload-database: true
          wait-for-processing: true

  # Custom security checks for JavaScript/TypeScript
  security-scan:
    name: Additional Security Scans
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Run npm audit
        run: |
          echo "Running npm audit..."
          npm audit --audit-level=moderate --json > npm-audit.json || true
          npm audit --audit-level=moderate
        continue-on-error: true

      - name: Check for hardcoded secrets
        run: |
          echo "Scanning for hardcoded secrets..."
          # Patterns to check for potential secrets
          PATTERNS=(
            "password\s*=\s*['\"][^'\"]+['\"]"
            "api_key\s*=\s*['\"][^'\"]+['\"]"
            "secret\s*=\s*['\"][^'\"]+['\"]"
            "token\s*=\s*['\"][^'\"]+['\"]"
            "private_key\s*=\s*['\"][^'\"]+['\"]"
            "aws_access_key_id"
            "aws_secret_access_key"
            "[-0-9a-f]{32,}"  # Potential API keys
          )

          FOUND=0
          for pattern in "${PATTERNS[@]}"; do
            if grep -riE "$pattern" packages/ src/ --include="*.ts" --include="*.js" --exclude-dir=node_modules --exclude-dir=dist; then
              FOUND=1
            fi
          done

          if [[ $FOUND -eq 1 ]]; then
            echo "Warning: Potential hardcoded secrets found. Please review."
          fi
        continue-on-error: true

      - name: Run Snyk security scan
        if: env.SNYK_TOKEN != ''
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: |
          npm install -g snyk
          snyk test --severity-threshold=high || true
        continue-on-error: true

      - name: Check for dependency vulnerabilities
        run: |
          echo "Checking for known vulnerabilities..."
          npm audit --production --audit-level=high
        continue-on-error: true

  # CodeQL database analysis
  database-analysis:
    name: Database Queries Analysis
    runs-on: ubuntu-latest
    needs: analyze
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Download CodeQL database
        uses: github/codeql-action/database-upload@v3
        with:
          language: javascript
          database: github/codeql

  # Security summary
  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [analyze, security-scan]
    if: always()
    steps:
      - name: Generate security summary
        run: |
          echo "## Security Scan Summary 🔒" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| CodeQL Analysis | ${{ needs.analyze.result == 'success' && '✅ Passed' || '⚠️ Review Required' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Additional Scans | ${{ needs.security-scan.result == 'success' && '✅ Passed' || '⚠️ Review Required' }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Recommendations:**" >> $GITHUB_STEP_SUMMARY
          echo "- Review all security warnings in the Actions tab" >> $GITHUB_STEP_SUMMARY
          echo "- Address high/critical severity issues promptly" >> $GITHUB_STEP_SUMMARY
          echo "- Keep dependencies updated" >> $GITHUB_STEP_SUMMARY

      - name: Comment on PR
        if: github.event_name == 'pull_request' && (needs.analyze.result == 'failure' || needs.security-scan.result == 'failure')
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '⚠️ **Security Issues Detected**\n\nPlease review the security scan results in the Actions tab. High or critical severity issues must be addressed before merging.'
            })