security.yml

##############################################################################
# Security Workflow — Nova Launch
#
# Runs automated vulnerability scanning and the backend security test suite
# on every push and PR using:
#   - npm audit        (Node.js dependency vulnerabilities)
#   - Snyk             (deep dependency graph + license scanning)
#   - cargo audit      (Rust dependency vulnerabilities)
#   - CodeQL           (static analysis / SAST)
#   - Trivy            (container image scanning)
#   - Secret scanning  (hardcoded credentials / tokens)
#   - Backend security test suite (auth, arithmetic, timing, event tampering, DoS)
#
# Results are uploaded to GitHub Security tab (SARIF format).
#
# Required secrets:
#   SNYK_TOKEN — obtain from https://app.snyk.io/account
##############################################################################

name: Security

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Full scan every day at 02:00 UTC (catches newly disclosed CVEs)
    - cron: "0 2 * * *"
  workflow_dispatch:
    inputs:
      fail_on_severity:
        description: "Minimum severity to fail the build (low|medium|high|critical)"
        required: false
        default: "high"

# Cancel in-progress runs on the same branch to save CI minutes
concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write # required to upload SARIF to GitHub Security tab
  actions: read

env:
  # Default severity threshold — override via workflow_dispatch input
  FAIL_ON_SEVERITY: ${{ github.event.inputs.fail_on_severity || 'high' }}

jobs:
  ##############################################################################
  # 1. npm audit — backend
  ##############################################################################
  npm-audit-backend:
    name: npm audit (backend)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        working-directory: backend
        run: npm ci --ignore-scripts

      - name: Run npm audit
        working-directory: backend
        # --audit-level=high fails on high/critical; moderate issues are reported
        run: |
          npm audit --audit-level=high --json > npm-audit-backend.json || true
          npm audit --audit-level=high

      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: npm-audit-backend
          path: backend/npm-audit-backend.json
          retention-days: 30

  ##############################################################################
  # 2. npm audit — frontend
  ##############################################################################
  npm-audit-frontend:
    name: npm audit (frontend)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"

      - name: Install dependencies
        working-directory: frontend
        run: npm install --ignore-scripts

      - name: Run npm audit
        working-directory: frontend
        run: |
          npm audit --audit-level=high --json > npm-audit-frontend.json || true
          npm audit --audit-level=high

      - name: Upload audit report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: npm-audit-frontend
          path: frontend/npm-audit-frontend.json
          retention-days: 30

  ##############################################################################
  # 3. Snyk — backend (deep dependency graph + license scan)
  ##############################################################################
  snyk-backend:
    name: Snyk (backend)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    # Skip on forks — SNYK_TOKEN won't be available
    if: github.event.repository.fork == false

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"
          cache: npm
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        working-directory: backend
        run: npm ci --ignore-scripts

      - name: Run Snyk vulnerability scan
        uses: snyk/actions/node@master
        continue-on-error: true # upload SARIF even on findings
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >
            --severity-threshold=${{ env.FAIL_ON_SEVERITY }}
            --sarif-file-output=snyk-backend.sarif
            --file=backend/package.json
            --project-name=nova-launch-backend

      - name: Upload Snyk SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: snyk-backend.sarif
          category: snyk-backend

      - name: Upload Snyk SARIF artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: snyk-backend-sarif
          path: snyk-backend.sarif
          retention-days: 30

  ##############################################################################
  # 4. Snyk — frontend
  ##############################################################################
  snyk-frontend:
    name: Snyk (frontend)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event.repository.fork == false

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"

      - name: Install dependencies
        working-directory: frontend
        run: npm install --ignore-scripts

      - name: Run Snyk vulnerability scan
        uses: snyk/actions/node@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >
            --severity-threshold=${{ env.FAIL_ON_SEVERITY }}
            --sarif-file-output=snyk-frontend.sarif
            --file=frontend/package.json
            --project-name=nova-launch-frontend

      - name: Upload Snyk SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: snyk-frontend.sarif
          category: snyk-frontend

      - name: Upload Snyk SARIF artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: snyk-frontend-sarif
          path: snyk-frontend.sarif
          retention-days: 30

  ##############################################################################
  # 5. Snyk — Rust / Cargo (smart contracts)
  ##############################################################################
  snyk-contracts:
    name: Snyk (contracts)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    if: github.event.repository.fork == false

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Run Snyk vulnerability scan (Rust)
        uses: snyk/actions/rust@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: >
            --severity-threshold=${{ env.FAIL_ON_SEVERITY }}
            --sarif-file-output=snyk-contracts.sarif
            --file=contracts/token-factory/Cargo.toml
            --project-name=nova-launch-contracts

      - name: Upload Snyk SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: snyk-contracts.sarif
          category: snyk-contracts

      - name: Upload Snyk SARIF artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: snyk-contracts-sarif
          path: snyk-contracts.sarif
          retention-days: 30

  ##############################################################################
  # 6. cargo audit — Rust dependencies
  ##############################################################################
  cargo-audit:
    name: cargo audit (contracts)
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Install Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo registry
        uses: actions/cache@v6
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
          key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        working-directory: contracts/token-factory
        run: |
          cargo audit --json > cargo-audit.json || true
          cargo audit

      - name: Upload cargo audit report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: cargo-audit-report
          path: contracts/token-factory/cargo-audit.json
          retention-days: 30

  ##############################################################################
  # 7. CodeQL — Static Application Security Testing (SAST)
  ##############################################################################
  codeql:
    name: CodeQL SAST
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # CodeQL is free for public repos; skip on forks to avoid token issues
    if: github.event.repository.fork == false

    strategy:
      fail-fast: false
      matrix:
        language: [javascript-typescript]

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # Use the security-extended query suite for broader coverage
          queries: security-extended,security-and-quality
          config: |
            paths:
              - backend/src
              - frontend/src
            paths-ignore:
              - "**/*.test.ts"
              - "**/*.spec.ts"
              - "**/node_modules"
              - "**/dist"
              - "**/__tests__"

      - name: Setup Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "20"

      - name: Install backend dependencies
        working-directory: backend
        run: npm ci --ignore-scripts

      - name: Install frontend dependencies
        working-directory: frontend
        run: npm install --ignore-scripts

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: codeql-${{ matrix.language }}
          upload: true

  ##############################################################################
  # 8. Trivy — container image scanning
  ##############################################################################
  trivy-backend:
    name: Trivy (backend image)
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Build backend Docker image
        working-directory: backend
        run: |
          docker build -t nova-launch-backend:scan .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: nova-launch-backend:scan
          format: sarif
          output: trivy-backend.sarif
          severity: "CRITICAL,HIGH"
          exit-code: "0" # don't fail — upload results for review

      - name: Upload Trivy SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v4
        if: always()
        with:
          sarif_file: trivy-backend.sarif
          category: trivy-backend

      - name: Upload Trivy SARIF artifact
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: trivy-backend-sarif
          path: trivy-backend.sarif
          retention-days: 30

  ##############################################################################
  # 9. Secret scanning — detect hardcoded credentials
  ##############################################################################
  secret-scan:
    name: Secret Scanning (Gitleaks)
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Checkout (full history for git log scanning)
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        uses: gitleaks/gitleaks-action@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}  # required for private repos
        with:
          args: detect --source . --verbose --redact

  ##############################################################################
  # 10. Aggregate report — summarise all scan results
  ##############################################################################
  security-summary:
    name: Security Summary
    runs-on: ubuntu-latest
    timeout-minutes: 10
    needs:
      - npm-audit-backend
      - npm-audit-frontend
      - cargo-audit
    if: always()

    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Download all artifacts
        uses: actions/download-artifact@v8
        with:
          path: scan-results

      - name: Generate summary
        run: |
          echo "## 🔒 Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Scanner | Target | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|---------|--------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| npm audit | backend | ${{ needs.npm-audit-backend.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| npm audit | frontend | ${{ needs.npm-audit-frontend.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
          echo "| cargo audit | contracts | ${{ needs.cargo-audit.result == 'success' && '✅ Pass' || '❌ Fail' }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Full results are available in the [Security tab](../../security/code-scanning)." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Scan triggered by:** \`${{ github.event_name }}\` on \`${{ github.ref_name }}\`" >> $GITHUB_STEP_SUMMARY
          echo "**Commit:** \`${{ github.sha }}\`" >> $GITHUB_STEP_SUMMARY

      - name: Post PR comment
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const body = [
              '## 🔒 Security Scan Results',
              '',
              '| Scanner | Target | Status |',
              '|---------|--------|--------|',
              `| npm audit | backend | ${{ needs.npm-audit-backend.result == 'success' && '✅ Pass' || '❌ Fail' }} |`,
              `| npm audit | frontend | ${{ needs.npm-audit-frontend.result == 'success' && '✅ Pass' || '❌ Fail' }} |`,
              `| cargo audit | contracts | ${{ needs.cargo-audit.result == 'success' && '✅ Pass' || '❌ Fail' }} |`,
              '',
              'Full results are in the [Security tab](../../security/code-scanning).',
            ].join('\n');

            // Find existing comment to update rather than creating duplicates
            const { data: comments } = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });

            const existing = comments.find(c =>
              c.user.type === 'Bot' && c.body.includes('Security Scan Results')
            );

            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

  ##############################################################################
  # 11. Backend security test suite (auth, arithmetic, timing, events, DoS)
  ##############################################################################
  security-tests:
    name: Run Security Test Suite
    runs-on: ubuntu-latest
    timeout-minutes: 15

    strategy:
      matrix:
        node-version: [18.x, 20.x]

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Setup Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v7
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
          cache-dependency-path: backend/package-lock.json

      - name: Install dependencies
        working-directory: backend
        run: npm ci

      - name: Run Authentication Security Tests
        working-directory: backend
        run: npm run test:security:auth
        env:
          NODE_ENV: test

      - name: Run Arithmetic Security Tests
        working-directory: backend
        run: npm run test:security:arithmetic
        env:
          NODE_ENV: test

      - name: Run Timing & Race Condition Tests
        working-directory: backend
        run: npm run test:security:timing
        env:
          NODE_ENV: test

      - name: Run Event Tampering Tests
        working-directory: backend
        run: npm run test:security:events
        env:
          NODE_ENV: test

      - name: Run DoS Protection Tests
        working-directory: backend
        run: npm run test:security:dos
        env:
          NODE_ENV: test

      - name: Generate Security Test Coverage
        working-directory: backend
        run: npm run test:security:coverage
        env:
          NODE_ENV: test

      - name: Upload Coverage Reports
        uses: codecov/codecov-action@v6
        with:
          files: ./backend/coverage/coverage-final.json
          flags: security-tests
          name: security-coverage-${{ matrix.node-version }}
          fail_ci_if_error: false

      - name: Check Coverage Thresholds
        working-directory: backend
        run: |
          echo "Verifying security test coverage meets requirements..."
          # Critical risks must have 100% coverage
          # High risks must have 95% coverage
          # Medium risks must have 80% coverage

  threat-model-validation:
    name: Validate Threat Model Coverage
    runs-on: ubuntu-latest
    needs: security-tests

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Validate Risk Matrix
        run: |
          echo "Checking threat model risk matrix..."

          # Verify all critical risks have tests
          CRITICAL_RISKS="AUTH-001 AUTH-002 AUTH-003 AUTH-004 AUTH-005 AUTH-006 AUTH-007 AUTH-008 REPLAY-001 REPLAY-004"

          for risk in $CRITICAL_RISKS; do
            if ! grep -r "$risk" backend/src/__tests__/security*.test.ts > /dev/null; then
              echo "ERROR: Critical risk $risk has no test coverage!"
              exit 1
            fi
          done

          echo "✓ All critical risks have test coverage"

      - name: Verify No Skipped Critical Tests
        working-directory: backend
        run: |
          # Check for .skip or .todo in security tests
          if grep -r "describe\.skip\|it\.skip\|test\.skip" src/__tests__/security*.test.ts; then
            echo "ERROR: Found skipped security tests!"
            exit 1
          fi

          echo "✓ No skipped security tests found"

      - name: Check Test Documentation
        run: |
          # Verify each test file has RISK COVERAGE header
          for file in backend/src/__tests__/security*.test.ts; do
            if ! grep -q "RISK COVERAGE:" "$file"; then
              echo "ERROR: $file missing RISK COVERAGE documentation!"
              exit 1
            fi
          done

          echo "✓ All security tests are properly documented"

  security-report:
    name: Generate Security Report
    runs-on: ubuntu-latest
    needs: [security-tests, threat-model-validation]
    if: always()

    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Generate Report
        run: |
          echo "# Security Test Report" > security-report.md
          echo "" >> security-report.md
          echo "## Test Execution Summary" >> security-report.md
          echo "- Date: $(date)" >> security-report.md
          echo "- Branch: ${{ github.ref_name }}" >> security-report.md
          echo "- Commit: ${{ github.sha }}" >> security-report.md
          echo "" >> security-report.md
          echo "## Risk Coverage" >> security-report.md
          echo "All high and critical risks from the threat model have been tested." >> security-report.md
          echo "" >> security-report.md
          echo "See [THREAT_MODEL_RISK_MATRIX.md](backend/THREAT_MODEL_RISK_MATRIX.md) for details." >> security-report.md

      - name: Upload Report
        uses: actions/upload-artifact@v7
        with:
          name: security-test-report
          path: security-report.md
          retention-days: 30

      - name: Comment on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const report = fs.readFileSync('security-report.md', 'utf8');

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: report
            });