HealthLog/.github/workflows/security.yml

name: Security & Quality

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  quality:
    name: Lint, Typecheck & Test
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile

      - run: pnpm db:generate

      # Blocking since v1.15.20 — the settings-split refactor that kept
      # this warn-only is long done and the tree lints clean.
      - name: ESLint
        run: pnpm lint

      # Prettier formatting gate. The format pass excludes generator-owned
      # artifacts via .prettierignore (notably docs/api/openapi.yaml, which
      # the OpenAPI drift check below enforces byte-for-byte).
      - name: Prettier format check
        run: pnpm format:check

      - name: TypeScript strict check
        run: pnpm typecheck

      - name: Unit tests
        run: pnpm test

      # OpenAPI spec drift gate — hard-fail (flipped from warn-only in v1.4.25).
      #
      # The Zod registry is the source of truth for the public API contract.
      # Any route signature change must be reflected in `docs/api/openapi.yaml`
      # so downstream consumers (notably the v1.5 iOS Swift codegen) stay in
      # lockstep. If this step fails, run `pnpm openapi:generate` locally and
      # commit the regenerated spec.
      - name: OpenAPI spec drift check
        run: |
          pnpm openapi:generate
          if ! git diff --exit-code docs/api/openapi.yaml; then
            echo "::error::OpenAPI drift detected — regenerate the spec via 'pnpm openapi:generate' and commit the result. The Zod registry under src/lib/openapi/ is the source of truth for the public API contract."
            exit 1
          fi
          echo "::notice::OpenAPI spec in sync with Zod source schemas."

  dependency-audit:
    name: Dependency Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: 22
          cache: "pnpm"

      - run: pnpm install --frozen-lockfile

      # Blocking since v1.15.20 — a HIGH/CRITICAL advisory against a
      # production dependency fails the build. If an advisory has no
      # upstream fix yet, pin an `auditConfig.ignoreCves` entry in
      # package.json (pnpm's documented suppression mechanism) with a
      # comment referencing the tracking issue, rather than flipping
      # this step back to warn-only.
      - name: Audit for known vulnerabilities
        run: pnpm audit --prod --audit-level=high

  secret-scan:
    name: Secret Scanning
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Gitleaks secret scan
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  docker-security:
    name: Container Security
    runs-on: ubuntu-latest
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Build Docker image
        run: docker build -t healthlog:scan .

      - name: Install Trivy
        run: |
          sudo apt-get install -y wget apt-transport-https gnupg
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee /etc/apt/sources.list.d/trivy.list
          sudo apt-get update && sudo apt-get install -y trivy

      # Blocking since v1.15.20 — a HIGH/CRITICAL finding in the built
      # image fails the job. For a finding without an upstream fix
      # (e.g. a base-image CVE Alpine has not patched yet), add the CVE
      # id to a `.trivyignore` file at the repository root — Trivy reads
      # it automatically — one CVE per line, each with a comment naming
      # the tracking issue and the re-check condition. Never suppress a
      # finding that has a fixed version available; bump instead.
      - name: Trivy container scan
        run: trivy image --format table --severity CRITICAL,HIGH --exit-code 1 healthlog:scan