# 安全检查套件 —— 密钥扫描 / 依赖漏洞 / 工作流与镜像静态检查
# 本文件为 GovAi 自行编写，所用工具均为宽松许可（MIT/Apache 等），
# 在 CI 中作为独立分析器运行，不与本项目代码链接。未复制任何第三方项目配置。
name: Security

on:
  push:
    branches: [main, master, dev]
  pull_request:
  schedule:
    - cron: "0 3 * * 1" # 每周一 03:00 UTC 定时复扫

permissions:
  contents: read

concurrency:
  group: security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ---- 阻断类：发现问题应修复后再合并 ----
  secret-scan:
    name: 密钥扫描 (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0 # 全量历史，便于扫描历史提交中的密钥
      - name: 安装 gitleaks
        run: |
          VERSION=8.18.4
          curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks
          sudo install gitleaks /usr/local/bin/gitleaks
      - name: 扫描
        run: gitleaks detect --source . --redact --no-banner --verbose

  go-vuln:
    name: Go 依赖漏洞 (govulncheck)
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: server
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: server/go.mod
          cache-dependency-path: server/go.sum
      - name: 安装 govulncheck
        run: go install golang.org/x/vuln/cmd/govulncheck@latest
      - name: 扫描
        run: govulncheck ./...

  workflow-lint:
    name: 工作流静态检查 (actionlint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: 安装并运行 actionlint
        run: |
          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
          ./actionlint -color

  docker-lint:
    name: Dockerfile 静态检查 (hadolint)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: hadolint - ppt-worker Dockerfile
        uses: hadolint/hadolint-action@v3.1.0
        with:
          dockerfile: ppt-worker/Dockerfile

  # ---- 建议类：报告问题但不阻断合并 ----
  dependency-audit:
    name: 依赖审计 (npm audit / trivy，建议性)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
          cache-dependency-path: apps/web/package-lock.json
      - name: npm audit (前端)
        working-directory: apps/web
        run: npm audit --audit-level=high
        continue-on-error: true
      - name: 安装 trivy
        run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin
      - name: trivy 文件系统扫描（依赖 CVE）
        run: trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 0 .
        continue-on-error: true