name: Security Checks

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  schedule:
    # Esecuzione settimanale per intercettare nuove CVE su versioni in lock
    - cron: '0 4 * * 1'

jobs:
  composer-audit:
    name: Composer audit & validate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup PHP
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: mbstring, pdo, pdo_mysql, openssl, fileinfo, gd, zip, intl, bcmath
          coverage: none

      - name: Validate composer files
        run: composer validate --strict --no-check-publish

      - name: Install dependencies
        run: composer install --prefer-dist --no-progress --no-interaction --optimize-autoloader

      - name: Composer audit
        run: composer audit --no-dev --abandoned=report

  npm-audit:
    name: NPM audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '18'

      - name: Install dependencies
        run: npm ci || npm install

      - name: NPM audit (production)
        run: npm audit --omit=dev --audit-level=high

  secret-scan:
    name: Secret scanning (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  sast-semgrep:
    name: Static analysis (Semgrep)
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run Semgrep
        run: |
          semgrep --config=p/php \
                  --config=p/security-audit \
                  --config=p/owasp-top-ten \
                  --error \
                  --severity ERROR \
                  --exclude vendor \
                  --exclude node_modules \
                  --exclude storage \
                  --exclude public/vendor

  laravel-config-checks:
    name: Laravel security configuration checks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Verify .env is gitignored
        run: |
          if git ls-files --error-unmatch .env > /dev/null 2>&1; then
            echo "ERROR: .env is tracked by git"
            exit 1
          fi

      - name: Pattern checks (high-risk PHP)
        run: |
          set +e
          ! grep -RInE "(^|[^a-zA-Z_])eval\s*\(" app/ routes/ --include='*.php' && \
          ! grep -RInE "unserialize\s*\(.*\\\$_(GET|POST|REQUEST|COOKIE)" app/ --include='*.php' && \
          ! grep -RInE "shell_exec|passthru|popen|proc_open" app/Http/ --include='*.php' && \
          ! grep -RInE "withoutMiddleware\s*\(\s*['\"]auth['\"]" routes/ --include='*.php'
        shell: bash
