security.yml

name: Security Scan

permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'  # Weekly Monday 6AM UTC

jobs:
  security:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v4

    - name: Setup .NET 10
      uses: actions/setup-dotnet@v4
      with:
        dotnet-version: '10.0.x'

    - name: Restore
      run: dotnet restore src/TSG/TSG.csproj --locked-mode

    - name: Vulnerability scan
      run: dotnet list src/TSG/TSG.csproj package --vulnerable --include-transitive

    - name: Deprecated scan
      run: dotnet list src/TSG/TSG.csproj package --deprecated --include-transitive

    - name: Build with analyzers
      run: dotnet build src/TSG/TSG.csproj -c Release --no-restore -warnaserror

    - name: Verify code formatting
      run: dotnet format src/TSG/TSG.csproj --verify-no-changes --no-restore

    - name: Publication boundary scan
      shell: bash
      run: |
        if git ls-files | grep -E '(^|/)(bin|obj|\.vs|node_modules|publish|artifacts)/|(^|/)\.env$|terminal\.db$|NuGet\.Config$'; then
          echo "Blocked generated, local-feed, database, or credential-bearing files are tracked."
          exit 1
        fi

    - name: Generate audit report
      run: |
        echo "# 🛡️ TSG Security Audit Report" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "**Date:** $(date -u +%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_STEP_SUMMARY
        echo "**Commit:** ${{ github.sha }}" >> $GITHUB_STEP_SUMMARY
        echo "" >> $GITHUB_STEP_SUMMARY
        echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
        echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
        echo "| Vulnerable packages | ✅ None |" >> $GITHUB_STEP_SUMMARY
        echo "| Deprecated packages | ✅ None |" >> $GITHUB_STEP_SUMMARY
        echo "| Direct package references | ✅ Microsoft.Data.Sqlite + patched SQLite native pin |" >> $GITHUB_STEP_SUMMARY
        echo "| Static analysis (CA) | ✅ Clean |" >> $GITHUB_STEP_SUMMARY
        echo "| NuGet audit enabled | ✅ Level: low |" >> $GITHUB_STEP_SUMMARY