name: 'Security'

# ----------------------------------------------------------------------------------
# 📦 Security Workflow for pnpm Projects
#
# This workflow ensures supply chain security using:
# 1. GitHub Dependency Review on pull requests
# 2. pnpm audit for npm-specific vulnerability scanning
# 3. Google OSV-Scanner for comprehensive vulnerability scanning
#
# 🔁 Triggers:
# - On push to: main, dev, staging
# - On pull requests targeting: main, dev, staging
# - Can be called as reusable workflow from other repositories
# ----------------------------------------------------------------------------------

on:
  push:
    branches: [main, dev, staging]
  pull_request:
    branches: [main, dev, staging]
  
  # Allow being called as reusable workflow from other repos
  workflow_call:
    inputs:
      pnpm_version:
        description: 'pnpm version to use'
        required: false
        type: string
        default: '8'
      audit_level:
        description: 'Audit severity level (low, moderate, high, critical)'
        required: false
        type: string
        default: 'moderate'
      dependency_review_severity:
        description: 'Dependency review fail threshold (low, moderate, high, critical)'
        required: false
        type: string
        default: 'moderate'
      comment_summary:
        description: 'Post dependency review summary as PR comment'
        required: false
        type: string
        default: 'always'
      skip_osv_scan:
        description: 'Skip Google OSV vulnerability scanning'
        required: false
        type: boolean
        default: false
      dependency_review:
        description: 'Skip dependency review step'
        required: false
        type: boolean
        default: false

# Permissions are inherited from calling workflow
# Calling workflow must have:
# Minimal read access required unless write/publish is added later
permissions:
   contents: read
   pull-requests: write
   security-events: write

jobs:
  # --------------------------------------
  # 🔍 GitHub Dependency Review (Pull Requests Only)
  # --------------------------------------
  dependency-review:
    if: ${{ github.event_name == 'pull_request' && inputs.dependency_review != true }}
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout repository'
        uses: actions/checkout@v4

      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4
        with:
          comment-summary-in-pr: ${{ inputs.comment_summary || 'always' }}
          fail-on-severity: ${{ inputs.dependency_review_severity || 'moderate' }}

  # --------------------------------------
  # 🛡️ pnpm Security Audit
  # --------------------------------------
  security-audit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v2
        with:
          version: ${{ inputs.pnpm_version || '8' }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22.4.x'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install

      - name: Run pnpm security audit
        run: |
          echo "🔍 Running pnpm security audit..."
          pnpm audit --audit-level ${{ inputs.audit_level || 'moderate' }}

  # --------------------------------------
  # 🔬 Google OSV-Scanner (Uses Official Reusable Workflow)
  # --------------------------------------
  osv-scan:
    if: ${{ inputs.skip_osv_scan != true }}
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.3"
    with:
      scan-args: |-
        --recursive
        ./
      # Strict on main/production, more lenient on dev branches
      fail-on-vuln: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/staging' }}
    permissions:
      # Required for uploading SARIF to Security tab
      security-events: write
      # Required to read repository contents
      contents: read
      # Required to access actions
      actions: read