security.yml

name: Security

on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: read

jobs:
  gitleaks:
    name: Secret scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Run Gitleaks
        shell: bash
        run: |
          set -euo pipefail
          GITLEAKS_VERSION=8.24.2
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o gitleaks.tar.gz
          tar -xzf gitleaks.tar.gz gitleaks
          chmod +x gitleaks
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            ./gitleaks detect --source . --log-opts="origin/${{ github.base_ref }}..HEAD" --verbose
          else
            ./gitleaks detect --source . --verbose
          fi

  dependency-audit:
    name: Dependency audit
    runs-on: windows-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup .NET
        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
        with:
          global-json-file: global.json

      - name: Restore
        run: dotnet restore IronTrace.sln

      - name: Vulnerable package scan
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          $output = dotnet list IronTrace.sln package --vulnerable --include-transitive 2>&1 | Out-String
          Write-Host $output
          if ($output -match '(?i)\b(Critical|High)\b') {
            Write-Error 'High or Critical NuGet vulnerabilities detected.'
            exit 1
          }