security.yml

name: Security Audit

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]
  schedule:
    - cron: '0 4 * * 1'  # Monday 04:00 UTC

permissions:
  contents: read

concurrency:
  group: security-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

env:
  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
  DOTNET_CLI_TELEMETRY_OPTOUT: true
  DOTNET_NOLOGO: true
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

jobs:
  dependency-review:
    name: Dependency Review (PR only)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - name: Dependency Review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high
          deny-licenses: GPL-2.0, GPL-3.0, AGPL-3.0
          comment-summary-in-pr: always

  vulnerability-scan:
    name: Vulnerable Package Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0

      - name: Setup .NET from global.json
        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
        with:
          global-json-file: global.json

      - name: Display .NET SDK info
        run: dotnet --info

      - name: Restore dependencies
        run: |
          dotnet restore CaeriusNet.slnx --locked-mode
          dotnet restore tools/CaeriusNet.SqlServer.Contracts/CaeriusNet.SqlServer.Contracts.csproj --locked-mode

      - name: Scan for vulnerable packages (published packages)
        run: |
          set -euo pipefail

          projects=(
            "src/CaeriusNet/CaeriusNet.csproj|CaeriusNet"
            "src/CaeriusNet.Redis/CaeriusNet.Redis.csproj|CaeriusNet.Redis"
            "src/CaeriusNet.Aspire/CaeriusNet.Aspire.csproj|CaeriusNet.Aspire"
            "src/CaeriusNet.Contracts/CaeriusNet.Contracts.csproj|CaeriusNet.Contracts"
            "tools/CaeriusNet.SqlServer.Contracts/CaeriusNet.SqlServer.Contracts.csproj|CaeriusNet.SqlServer.Contracts"
          )

          total_vulnerabilities=0
          for item in "${projects[@]}"; do
            IFS='|' read -r project label <<< "$item"
            echo "=== Scanning ${project} for vulnerabilities ==="
            result=$(dotnet package list --project "$project" --vulnerable --include-transitive --format json --no-restore 2>&1)
            echo "$result"
            count=$(echo "$result" | jq '[.projects[]? | (.frameworks // [])[] | ((.topLevelPackages // [])[], (.transitivePackages // [])[]) | select((.vulnerabilities // []) | length > 0)] | length')
            if [ "$count" -gt 0 ]; then
              echo "::error title=Vulnerable Packages::${count} vulnerable NuGet package(s) detected in ${label}. See log for details."
              total_vulnerabilities=$((total_vulnerabilities + count))
            else
              echo "No vulnerable packages found in ${label}."
            fi
          done

          if [ "$total_vulnerabilities" -gt 0 ]; then
            exit 1
          fi

      - name: Scan for deprecated packages (published packages)
        run: |
          set -euo pipefail

          projects=(
            "src/CaeriusNet/CaeriusNet.csproj|CaeriusNet"
            "src/CaeriusNet.Redis/CaeriusNet.Redis.csproj|CaeriusNet.Redis"
            "src/CaeriusNet.Aspire/CaeriusNet.Aspire.csproj|CaeriusNet.Aspire"
            "src/CaeriusNet.Contracts/CaeriusNet.Contracts.csproj|CaeriusNet.Contracts"
            "tools/CaeriusNet.SqlServer.Contracts/CaeriusNet.SqlServer.Contracts.csproj|CaeriusNet.SqlServer.Contracts"
          )

          total_deprecated=0
          for item in "${projects[@]}"; do
            IFS='|' read -r project label <<< "$item"
            result=$(dotnet package list --project "$project" --deprecated --include-transitive --format json --no-restore 2>&1)
            echo "$result"
            count=$(echo "$result" | jq '
              def has_deprecation:
                ((.deprecationReasons? // []) |
                  if type == "array" then length > 0
                  elif type == "string" then length > 0
                  else false
                  end)
                or ((.message? // .deprecationMessage? // "") |
                  type == "string" and length > 0);
              [
                .projects[]?
                | (.frameworks // [])[]
                | ((.topLevelPackages // [])[], (.transitivePackages // [])[])
                | select(has_deprecation)
              ]
              | length')
            if [ "$count" -gt 0 ]; then
              echo "::error title=Deprecated Packages::${count} deprecated NuGet package(s) detected in ${label}."
              total_deprecated=$((total_deprecated + count))
            fi
          done

          test "$total_deprecated" -eq 0

      - name: Scan for vulnerable packages (full solution, informational)
        run: |
          echo "=== Scanning all solution projects for vulnerabilities (non-blocking) ==="
          dotnet package list --project CaeriusNet.slnx --vulnerable --include-transitive --format json --no-restore || true

      - name: Report outdated packages (informational)
        run: |
          echo "=== Outdated packages (informational, non-blocking) ==="
          dotnet package list --project CaeriusNet.slnx --outdated --no-restore || true
        continue-on-error: true