security-scanning.yml

# Security scanning workflow for secret detection and license compliance
name: Security Scanning

on:
  push:
    branches: [ "main", "develop" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    # Run weekly on Mondays at 08:00 UTC
    - cron: '0 8 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  security-events: write
  actions: read

env:
  DOTNET_VERSION: '9.0.102'
  NODE_VERSION: 'lts/*'

jobs:
  secret-scanning:
    name: Secret Detection
    runs-on: ubuntu-latest
    timeout-minutes: 15
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.10.1
        with:
          egress-policy: audit
          
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Run Gitleaks Scan
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Run TruffleHog OSS
        uses: trufflesecurity/trufflehog@90694bf9af66e7536abc5824e7a87246dbf933cb # v3.88.35
        with:
          path: ./
          base: main
          head: HEAD
          extra_args: --only-verified
  license-compliance:
    name: License Compliance
    runs-on: ubuntu-latest
    timeout-minutes: 20
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.10.1
        with:
          egress-policy: audit
          
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        
      - name: Setup .NET SDK
        uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Restore dependencies
        run: dotnet restore AgentAsAService.sln

      - name: Install license checker
        run: dotnet tool install --global dotnet-project-licenses

      - name: Check .NET licenses
        run: dotnet-project-licenses --input AgentAsAService.sln --output-format json --output licenses-dotnet.json --allowed-license-types MIT Apache-2.0 BSD-3-Clause ISC

      - name: Run FOSSA Scan
        uses: fossa-contrib/fossa-action@3d2ef181b1820d6dcd1972f86a767d18167fa19b # v3.0.1
        with:
          fossa-api-key: ${{ secrets.FOSSA_API_KEY }}

      - name: Setup Node.js
        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
          cache-dependency-path: '**/package-lock.json'

      - name: Install Node.js dependencies (if any)
        run: |
          if [ -f "package.json" ]; then
            npm ci
            npx license-checker --json > licenses-nodejs.json
          fi

      - name: Upload license reports
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: license-reports
          path: licenses-*.json
          retention-days: 90

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    timeout-minutes: 10
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.10.1
        with:
          egress-policy: audit
          
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Dependency Review
        uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9 # v4.7.1
        with:
          fail-on-severity: moderate
          allow-licenses: MIT, Apache-2.0, BSD-3-Clause, ISC, 0BSD, BSD-2-Clause
          deny-licenses: GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, AGPL-1.0, AGPL-3.0

  sbom-generation:
    name: SBOM Generation
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    timeout-minutes: 15
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.10.1
        with:
          egress-policy: audit
          
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup .NET SDK
        uses: actions/setup-dotnet@6bd8b7f7774af54e05809fcc5431931b3eb1ddee # v4.0.1
        with:
          dotnet-version: ${{ env.DOTNET_VERSION }}

      - name: Generate SBOM
        uses: anchore/sbom-action@e11c554f704a0b820cbf8c51673f6945e0731532 # v0.20.0
        with:
          path: ./
          format: spdx-json
          upload-artifact: true
          upload-release-assets: true

  security-scorecard:
    name: OpenSSF Scorecard
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      id-token: write
      contents: read
      actions: read
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    timeout-minutes: 10
    
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.10.1
        with:
          egress-policy: audit
          
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Run analysis
        uses: ossf/scorecard-action@f2ea147fec3c2f0d459703eba7405b5e9bcd8c8f # v2.4.2
        with:
          results_file: results.sarif
          results_format: sarif
          publish_results: true

      - name: Upload SARIF results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@bc02a25f6449997c5e9d5a368879b28f56ae19a1 # codeql-bundle-v2.21.4
        with:
          sarif_file: results.sarif