security.yml

name: security

# SAST and secret scanning, armed with automatic triggers (push/PR/schedule) so the
# controls actually run rather than existing on paper. The weekly schedule re-analyzes
# master with newly published query packs and re-scans the full git history even when no
# code changes. Conventions follow the sibling fhir-scorecard security workflow.
on:
  push:
    branches: [master]
  pull_request:
  schedule:
    - cron: "17 6 * * 1" # Mondays, 06:17 UTC
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  codeql:
    name: CodeQL analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    strategy:
      fail-fast: false
      matrix:
        # `python` analyzes the application code; `actions` analyzes the workflow
        # YAML itself for injection/permissions/dangerous-trigger issues.
        include:
          - language: python
            queries: security-and-quality
          - language: actions
            queries: ""
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: ${{ matrix.language }}
          queries: ${{ matrix.queries }}
      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7

  gitleaks:
    name: full-history secret scan (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Secret scan (gitleaks, full history)
        # Run the pinned gitleaks binary directly instead of a third-party action:
        # a checksum-verified, version-pinned binary is a deterministic supply-chain
        # pin. `gitleaks git` with a full-depth checkout walks the entire history.
        run: |
          GL=8.30.1
          BASE="https://github.com/gitleaks/gitleaks/releases/download/v${GL}"
          ARCHIVE="gitleaks_${GL}_linux_x64.tar.gz"
          curl -sSfL -o "/tmp/${ARCHIVE}" "${BASE}/${ARCHIVE}"
          curl -sSfL -o /tmp/gitleaks_checksums.txt "${BASE}/gitleaks_${GL}_checksums.txt"
          (cd /tmp && grep "  ${ARCHIVE}$" gitleaks_checksums.txt | sha256sum --check --strict)
          tar -xzf "/tmp/${ARCHIVE}" -C /tmp gitleaks
          /tmp/gitleaks git . --no-banner --redact --exit-code 1