lesson-security.yml

name: Lesson Security Scan

on:
  pull_request:
    paths:
      - "lessons/**"
  push:
    paths:
      - "lessons/**"

permissions:
  contents: read

jobs:
  lint:
    permissions:
      contents: read
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Scan lessons for dangerous patterns
        run: |
          echo "🔍 Scanning lessons for suspicious content..."
          EXIT_CODE=0
          # True-danger patterns only. \beval\b and \bexec\b were removed —
          # too high a false-positive rate: they have legitimate uses in
          # security-education content (shell fd locks `exec 9>...`, JS
          # `eval()`, Python `eval()`). rm -rf / curl|sh etc. have almost no
          # legitimate use in lessons. Fenced-code stripping (PR #1400) and
          # _archive/ exclusion already reduce remaining noise.
          PATTERNS=(
            'rm\s+-rf'
            'rm\s+-fr'
            ':(){ :|:& };:'
            'curl.+pipe.+sh'
            'wget.+pipe.+sh'
            'curl.+bash'
            'bash.+dev/tcp'
            # '`[^`]*`'  — removed: too noisy, flags all inline code
          )

          # Recursive scan: lessons/*.md misses lessons/contrib, lessons/core,
          # lessons/en etc. (the bulk of the corpus). Use find + rglob.
          # Exclude _archive/ directory (historical content, not active lessons)
          #
          # Strip fenced code blocks (``` ... ```) before scanning so that
          # dangerous patterns inside code examples don't trigger false positives.
          while IFS= read -r file; do
            # Remove fenced code blocks (both ``` and ~~~ variants)
            # and inline code (`...`) to avoid false positives
            stripped=$(sed '/^```/,/^```/d; /^~~~/, /^~~~/d; s/`[^`]*`//g' "$file")
            for pattern in "${PATTERNS[@]}"; do
              if echo "$stripped" | grep -Eq "$pattern" 2>/dev/null; then
                echo "⚠️  WARNING: Suspicious pattern found in $file (outside code block): $pattern"
                echo "$stripped" | grep -nE "$pattern" || true
                EXIT_CODE=1
              fi
            done
          done < <(find lessons -name "*.md" -type f -not -path "*/_archive/*" | sort)

          if [ "$EXIT_CODE" -eq 0 ]; then
            echo "✅ All lessons passed security scan."
          else
            echo "❌ Some lessons contain potentially dangerous patterns."
            echo ""
            echo "These may be legitimate (e.g., explaining a fix)."
            echo "Please review and ensure commands are wrapped in code blocks."
          fi
          exit $EXIT_CODE

      - name: Scan for dangling shell commands outside code blocks
        run: |
          echo "🔍 Checking for unescaped shell commands..."
          EXIT_CODE=0
          while IFS= read -r file; do
            # Look for lines starting with $ or % that aren't in code blocks
            # Simple heuristic: check if backtick-wrapped
            while IFS= read -r line; do
              if echo "$line" | grep -Eq '^\s*\$[^$]' && \
                 ! echo "$line" | grep -Eq '^\s*```'; then
                # This might be a shell command outside a code block
                echo "ℹ️  Review: $file → $line"
              fi
            done < "$file"
          done < <(find lessons -name "*.md" -type f -not -path "*/_archive/*" | sort)
          echo "✅ Scan complete."