GitHub Actions & CI/CD

# .github/workflows/security-pipeline.yml
name: 🛡️ Security & Quality Pipeline

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  # Job 1: Static Code Analysis
  static-analysis:
    name: 🔍 Static Code Analysis
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      # Security scanning with CodeQL
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript, python
      
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
      
      # Dependency vulnerability scanning
      - name: Run npm audit
        run: |
          npm audit --audit-level=critical
          npm audit --audit-level=high --dry-run
      
      # License compliance check
      - name: License compliance
        run: |
          npm install -g license-checker
          license-checker --onlyAllow "MIT;Apache-2.0;BSD;ISC"

  # Job 2: Security Secrets Scanning
  secrets-scan:
    name: 🔐 Secrets Detection
    runs-on: ubuntu-latest
    
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      
      - name: Run TruffleHog OSS
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
      
      - name: Check for hardcoded secrets
        run: |
          # Custom secret patterns
          if grep -r "password.*=" --include="*.js" --include="*.py" .; then
            echo "❌ Potential hardcoded passwords found"
            exit 1
          fi
          
          if grep -r "api[_-]?key.*=" --include="*.js" --include="*.py" .; then
            echo "❌ Potential API keys found"
            exit 1
          fi
          
          echo "✅ No obvious secrets detected"

  # Job 3: Container Security (if using Docker)
  container-security:
    name: 🐳 Container Security Scan
    runs-on: ubuntu-latest
    if: contains(github.event.head_commit.modified, 'Dockerfile')
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Build Docker image
        run: docker build -t security-scan:${{ github.sha }} .
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'security-scan:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  # Job 4: Quality Gates
  quality-gates:
    name: 📊 Quality Assessment
    runs-on: ubuntu-latest
    needs: [static-analysis, secrets-scan]
    
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '18'
          cache: 'npm'
      
      - name: Install dependencies
        run: npm ci
      
      # Code coverage requirements
      - name: Run tests with coverage
        run: npm run test:coverage
      
      - name: Coverage Quality Gate
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          echo "Coverage: $COVERAGE%"
          
          if (( $(echo "$COVERAGE < 80" | bc -l) )); then
            echo "❌ Coverage below 80% ($COVERAGE%)"
            exit 1
          fi
          
          echo "✅ Coverage requirement met: $COVERAGE%"
      
      # Code complexity analysis
      - name: Complexity Analysis
        run: |
          npm install -g complexity-report
          complexity-report --format json src/ > complexity.json
          
          MAX_COMPLEXITY=$(cat complexity.json | jq '.reports[].complexity.cyclomatic' | sort -n | tail -1)
          
          if (( MAX_COMPLEXITY > 10 )); then
            echo "❌ Cyclomatic complexity too high: $MAX_COMPLEXITY"
            exit 1
          fi
          
          echo "✅ Complexity check passed: $MAX_COMPLEXITY"
      
      # Performance benchmarks
      - name: Performance Benchmarks
        run: |
          npm run build
          
          # Check bundle size
          BUNDLE_SIZE=$(stat -c%s "dist/main.js")
          MAX_SIZE=1048576  # 1MB
          
          if [ $BUNDLE_SIZE -gt $MAX_SIZE ]; then
            echo "❌ Bundle size too large: $(($BUNDLE_SIZE / 1024))KB"
            exit 1
          fi
          
          echo "✅ Bundle size acceptable: $(($BUNDLE_SIZE / 1024))KB"