name: security-pipeline

on:

  push:

    branches: [main]

  pull_request:

    branches: [main]

  workflow_dispatch:

permissions:

  contents: read

  security-events: write

jobs:

  lint:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5

        with:

          python-version: "3.11"

      - run: pip install ruff==0.6.9

      - run: ruff check .

  sast:

    runs-on: ubuntu-latest

    needs: lint

    steps:

      - uses: actions/checkout@v4

      - uses: returntocorp/semgrep-action@v1

        with:

          config: >-

            p/default

            p/python

            p/flask

            .semgrep/rules.yml

          generateSarif: "1"

      - uses: github/codeql-action/upload-sarif@v3

        if: always()

        with:

          sarif_file: semgrep.sarif

          category: semgrep

  secrets:

    runs-on: ubuntu-latest

    needs: lint

    steps:

      - uses: actions/checkout@v4

        with:

          fetch-depth: 0

      - uses: gitleaks/gitleaks-action@v2

        env:

          GITLEAKS_CONFIG: .gitleaks.toml

  dependencies:

    runs-on: ubuntu-latest

    needs: lint

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5

        with:

          python-version: "3.11"

      - run: pip install pip-audit==2.7.3

      - run: pip-audit -r requirements.txt --strict --desc

  test:

    runs-on: ubuntu-latest

    needs: [sast, secrets, dependencies]

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5

        with:

          python-version: "3.11"

      - run: pip install -r requirements-dev.txt

      - run: pytest --cov=app --cov-report=term-missing

  notify-soc:

    runs-on: ubuntu-latest

    needs: [test]

    if: always()

    steps:

      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5

        with:

          python-version: "3.11"

      - run: python scripts/notify_soc.py

        env:

          SHUFFLE_WEBHOOK_URL: ${{ secrets.SHUFFLE_WEBHOOK_URL }}

          PIPELINE_STATUS: ${{ needs.test.result }}

          REPO: ${{ github.repository }}

          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

          COMMIT: ${{ github.sha }}

          ACTOR: ${{ github.actor }}