supply-chain.yml

name: Supply Chain Security

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday
  workflow_dispatch:

permissions:
  contents: read
  id-token: write       # OIDC for keyless signing / SLSA provenance
  packages: write       # Push attestations to GHCR
  security-events: write  # Upload SARIF results
  actions: read         # Required by SLSA provenance action

env:
  REGISTRY: ghcr.io
  IMAGE_BACKEND: ghcr.io/pinspace-org/gistpin-backend
  IMAGE_FRONTEND: ghcr.io/pinspace-org/gistpin-frontend

jobs:
  # ── 1. SBOM Generation ────────────────────────────────────────────────────
  sbom:
    name: Generate SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Generate SBOM (Syft)
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: spdx-json
          artifact-name: sbom.spdx.json
          output-file: sbom.spdx.json

      - name: Generate CycloneDX SBOM
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: cyclonedx-json
          artifact-name: sbom.cyclonedx.json
          output-file: sbom.cyclonedx.json

      - name: Upload SBOMs
        uses: actions/upload-artifact@v4
        with:
          name: sboms-${{ github.sha }}
          path: |
            sbom.spdx.json
            sbom.cyclonedx.json
          retention-days: 90

  # ── 2. Dependency Provenance & Vulnerability Scan ─────────────────────────
  dependency-provenance:
    name: Dependency Provenance
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Audit Backend dependencies
        working-directory: Backend
        run: npm audit --audit-level=high

      - name: Audit Frontend dependencies
        working-directory: Frontend
        run: npm audit --audit-level=high

      - name: Scan with OSV-Scanner
        uses: google/osv-scanner-action@v1
        with:
          scan-args: |-
            --recursive
            --format=sarif
            --output=osv-results.sarif
            ./

      - name: Upload OSV SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: osv-results.sarif
          category: osv-scanner

  # ── 3. Build Attestations ─────────────────────────────────────────────────
  build-attestation:
    name: Build Attestations
    runs-on: ubuntu-latest
    needs: [sbom]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    outputs:
      backend-digest: ${{ steps.build-backend.outputs.digest }}
      frontend-digest: ${{ steps.build-frontend.outputs.digest }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Log in to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push backend
        id: build-backend
        uses: docker/build-push-action@v5
        with:
          context: ./Backend
          file: infrastructure/docker/backend.Dockerfile
          push: true
          tags: ${{ env.IMAGE_BACKEND }}:sha-${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Build and push frontend
        id: build-frontend
        uses: docker/build-push-action@v5
        with:
          context: ./Frontend
          file: infrastructure/docker/frontend.Dockerfile
          push: true
          tags: ${{ env.IMAGE_FRONTEND }}:sha-${{ github.sha }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Download SBOMs
        uses: actions/download-artifact@v4
        with:
          name: sboms-${{ github.sha }}

      - name: Attest SBOM — backend
        run: |
          cosign attest --yes \
            --predicate sbom.spdx.json \
            --type spdxjson \
            "${{ env.IMAGE_BACKEND }}@${{ steps.build-backend.outputs.digest }}"

      - name: Attest SBOM — frontend
        run: |
          cosign attest --yes \
            --predicate sbom.spdx.json \
            --type spdxjson \
            "${{ env.IMAGE_FRONTEND }}@${{ steps.build-frontend.outputs.digest }}"

  # ── 4. SLSA Provenance ────────────────────────────────────────────────────
  slsa-provenance:
    name: SLSA Provenance
    needs: [build-attestation]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: ghcr.io/pinspace-org/gistpin-backend
      digest: ${{ needs.build-attestation.outputs.backend-digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}

  # ── 5. Signature Verification ─────────────────────────────────────────────
  verify-signatures:
    name: Verify Signatures
    runs-on: ubuntu-latest
    needs: [slsa-provenance]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Verify backend image signature
        run: |
          cosign verify \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            --certificate-identity-regexp "https://github.com/PinSpace-Org/GistPin/.*" \
            "${{ env.IMAGE_BACKEND }}@${{ needs.build-attestation.outputs.backend-digest }}"
        env:
          COSIGN_EXPERIMENTAL: "1"

  # ── 6. Generate full SBOM script ──────────────────────────────────────────
  sbom-script:
    name: SBOM via Script
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run generate-sbom.sh
        run: |
          chmod +x infrastructure/scripts/generate-sbom.sh
          infrastructure/scripts/generate-sbom.sh
        env:
          OUTPUT_DIR: ${{ runner.temp }}/sbom-output

      - name: Upload script-generated SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom-script-output-${{ github.sha }}
          path: ${{ runner.temp }}/sbom-output/
          retention-days: 90