# .github/workflows/devsecops-pipeline.yml
name: DevSecOps Security Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

env:
  SECURITY_GATE_ENABLED: true
  COMPLIANCE_REQUIRED: true
  ZERO_TOLERANCE_CRITICAL: true

jobs:
  security-gate-pre-build:
    name: Pre-Build Security Gates
    runs-on: ubuntu-latest
    outputs:
      security-approved: ${{ steps.gate-decision.outputs.approved }}
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0
    
    - name: Secret Scanning
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD
        extra_args: --debug --only-verified
    
    - name: License Compliance Check
      run: |
        npm install -g license-checker
        license-checker --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause'
    
    - name: Dependency Vulnerability Scan
      run: |
        npm audit --audit-level moderate
        pip safety check
        
    - name: Infrastructure Security Scan
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
    
    - name: Security Gate Decision
      id: gate-decision
      run: |
        python3 .github/scripts/security-gate-evaluator.py \
          --trivy-results trivy-results.sarif \
          --secrets-scan secrets-results.json \
          --dependency-scan dependency-results.json \
          --output gate-decision.json
        echo "approved=$(cat gate-decision.json | jq -r '.approved')" >> $GITHUB_OUTPUT

  static-application-security-testing:
    name: SAST Security Testing
    runs-on: ubuntu-latest
    needs: security-gate-pre-build
    if: needs.security-gate-pre-build.outputs.security-approved == 'true'
    steps:
    - uses: actions/checkout@v4
    
    - name: SonarQube Security Scan
      uses: sonarqube-quality-gate-action@master
      env:
        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
      with:
        scanMetadataReportFile: target/sonar/report-task.txt
    
    - name: CodeQL Analysis
      uses: github/codeql-action/analyze@v2
      with:
        languages: javascript,python,go,java
        queries: security-extended
    
    - name: Semgrep Security Scan
      run: |
        python -m pip install semgrep
        semgrep --config=auto --sarif --output=semgrep-results.sarif .
    
    - name: Custom Security Rules
      run: |
        python3 .github/scripts/custom-security-analyzer.py \
          --source-path . \
          --rules-config .security/custom-rules.yml \
          --output custom-security-results.json

  container-security-scanning:
    name: Container Security Gates
    runs-on: ubuntu-latest
    needs: [security-gate-pre-build, static-application-security-testing]
    steps:
    - uses: actions/checkout@v4
    
    - name: Build Container Image
      run: |
        docker build -t app:${{ github.sha }} .
    
    - name: Container Image Security Scan
      run: |
        # Trivy container scan
        trivy image --format sarif --output trivy-container.sarif app:${{ github.sha }}
        
        # Grype vulnerability scan
        grype app:${{ github.sha }} -o sarif --file grype-results.sarif
        
        # Syft SBOM generation
        syft app:${{ github.sha }} -o spdx-json --file sbom.spdx.json
    
    - name: Container Security Policy Validation
      run: |
        # OPA Gatekeeper policy validation
        conftest verify --policy .security/container-policies/ Dockerfile
        
        # CIS Benchmark compliance
        docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
          aquasec/trivy config --format table --exit-code 1 .
    
    - name: Image Signing and Attestation
      run: |
        # Sign container image with cosign
        cosign sign --key cosign.key app:${{ github.sha }}
        
        # Generate SLSA attestation
        cosign attest --key cosign.key --predicate sbom.spdx.json app:${{ github.sha }}

  dynamic-application-security-testing:
    name: DAST Security Testing
    runs-on: ubuntu-latest
    needs: container-security-scanning
    services:
      app:
        image: app:${{ github.sha }}
        ports:
          - 8080:8080
    steps:
    - name: OWASP ZAP Security Scan
      run: |
        docker run -t owasp/zap2docker-stable zap-baseline.py \
          -t http://app:8080 \
          -J zap-baseline-report.json \
          -w zap-baseline-report.md
    
    - name: Nuclei Security Scan
      run: |
        docker run projectdiscovery/nuclei:latest \
          -u http://app:8080 \
          -json-export nuclei-results.json
    
    - name: API Security Testing
      run: |
        # Postman/Newman API security tests
        newman run .security/api-security-tests.json \
          --environment .security/test-environment.json \
          --reporters json \
          --reporter-json-export api-security-results.json

  compliance-validation:
    name: Compliance and Governance Gates
    runs-on: ubuntu-latest
    needs: [static-application-security-testing, container-security-scanning]
    steps:
    - uses: actions/checkout@v4
    
    - name: SOC 2 Compliance Check
      run: |
        python3 .github/scripts/soc2-compliance-validator.py \
          --evidence-path ./compliance-evidence \
          --controls-config .security/soc2-controls.yml
    
    - name: PCI DSS Compliance Validation
      run: |
        # Validate PCI DSS requirements
        docker run --rm -v $(pwd):/workspace \
          pcidss/compliance-scanner:latest \
          --config /workspace/.security/pci-dss-config.yml
    
    - name: GDPR Privacy Impact Assessment
      run: |
        python3 .github/scripts/gdpr-pia-validator.py \
          --source-code . \
          --data-flow-config .security/data-flows.yml
    
    - name: Security Documentation Validation
      run: |
        # Validate security documentation completeness
        python3 .github/scripts/security-doc-validator.py \
          --docs-path ./docs/security \
          --requirements .security/doc-requirements.yml

  security-gate-final:
    name: Final Security Gate Decision
    runs-on: ubuntu-latest
    needs: [dynamic-application-security-testing, compliance-validation]
    outputs:
      deployment-approved: ${{ steps.final-gate.outputs.approved }}
    steps:
    - name: Aggregate Security Results
      run: |
        python3 .github/scripts/security-aggregator.py \
          --sast-results sast-results/ \
          --dast-results dast-results/ \
          --container-results container-results/ \
          --compliance-results compliance-results/ \
          --output final-security-report.json
    
    - name: Final Security Gate Decision
      id: final-gate
      run: |
        python3 .github/scripts/final-security-gate.py \
          --security-report final-security-report.json \
          --policy .security/deployment-policy.yml \
          --output final-decision.json
        echo "approved=$(cat final-decision.json | jq -r '.approved')" >> $GITHUB_OUTPUT
    
    - name: Security Metrics Collection
      run: |
        python3 .github/scripts/security-metrics-collector.py \
          --report final-security-report.json \
          --metrics-endpoint ${{ secrets.METRICS_ENDPOINT }}

  secure-deployment:
    name: Secure Deployment
    runs-on: ubuntu-latest
    needs: security-gate-final
    if: needs.security-gate-final.outputs.deployment-approved == 'true'
    environment: production
    steps:
    - name: Deploy to Production
      run: |
        echo "Deploying to production with security approval"
        # Deployment logic here

#!/usr/bin/env python3
# security-gate-evaluator.py

import json
import sys
import yaml
from pathlib import Path
from dataclasses import dataclass
from typing import List, Dict, Any
from enum import Enum

class Severity(Enum):
    CRITICAL = "critical"
    HIGH = "high"
    MEDIUM = "medium"
    LOW = "low"
    INFO = "info"

class SecurityGateStatus(Enum):
    APPROVED = "approved"
    REJECTED = "rejected"
    WARNING = "warning"

@dataclass
class SecurityFinding:
    id: str
    title: str
    severity: Severity
    description: str
    file_path: str = ""
    line_number: int = 0
    cwe_id: str = ""
    cve_id: str = ""
    confidence: str = "high"
    
class SecurityPolicy:
    def __init__(self, policy_config: Dict[str, Any]):
        self.max_critical = policy_config.get('max_critical_findings', 0)
        self.max_high = policy_config.get('max_high_findings', 5)
        self.max_medium = policy_config.get('max_medium_findings', 20)
        self.zero_tolerance_cves = policy_config.get('zero_tolerance_cves', [])
        self.required_compliance = policy_config.get('required_compliance', [])
        self.exclusions = policy_config.get('exclusions', [])

class SecurityGateEvaluator:
    def __init__(self, policy_path: str):
        with open(policy_path, 'r') as f:
            policy_config = yaml.safe_load(f)
        self.policy = SecurityPolicy(policy_config)
        self.findings: List[SecurityFinding] = []
        
    def add_trivy_results(self, trivy_file: str):
        """Parse Trivy SARIF results"""
        with open(trivy_file, 'r') as f:
            data = json.load(f)
            
        for run in data.get('runs', []):
            for result in run.get('results', []):
                finding = SecurityFinding(
                    id=result.get('ruleId', ''),
                    title=result.get('message', {}).get('text', ''),
                    severity=Severity(result.get('level', 'info')),
                    description=result.get('message', {}).get('text', ''),
                    file_path=result.get('locations', [{}])[0].get('physicalLocation', {}).get('artifactLocation', {}).get('uri', ''),
                    line_number=result.get('locations', [{}])[0].get('physicalLocation', {}).get('region', {}).get('startLine', 0)
                )
                self.findings.append(finding)
    
    def add_secrets_results(self, secrets_file: str):
        """Parse secrets scanning results"""
        with open(secrets_file, 'r') as f:
            data = json.load(f)
            
        for secret in data.get('secrets', []):
            finding = SecurityFinding(
                id=f"SECRET-{secret.get('type', 'UNKNOWN')}",
                title=f"Secret detected: {secret.get('type', 'Unknown')}",
                severity=Severity.CRITICAL,
                description=f"Potential secret found in {secret.get('file', 'unknown file')}",
                file_path=secret.get('file', ''),
                line_number=secret.get('line', 0)
            )
            self.findings.append(finding)
    
    def add_dependency_results(self, dependency_file: str):
        """Parse dependency vulnerability results"""
        with open(dependency_file, 'r') as f:
            data = json.load(f)
            
        for vuln in data.get('vulnerabilities', []):
            finding = SecurityFinding(
                id=vuln.get('id', ''),
                title=vuln.get('title', ''),
                severity=Severity(vuln.get('severity', 'medium').lower()),
                description=vuln.get('overview', ''),
                cve_id=vuln.get('cve', ''),
                file_path=vuln.get('module_name', '')
            )
            self.findings.append(finding)
    
    def evaluate_security_gate(self) -> Dict[str, Any]:
        """Evaluate findings against security policy"""
        critical_count = sum(1 for f in self.findings if f.severity == Severity.CRITICAL)
        high_count = sum(1 for f in self.findings if f.severity == Severity.HIGH)
        medium_count = sum(1 for f in self.findings if f.severity == Severity.MEDIUM)
        
        # Check for zero tolerance CVEs
        zero_tolerance_violations = [
            f for f in self.findings 
            if f.cve_id in self.policy.zero_tolerance_cves
        ]
        
        # Determine gate status
        status = SecurityGateStatus.APPROVED
        reasons = []
        
        if zero_tolerance_violations:
            status = SecurityGateStatus.REJECTED
            reasons.append(f"Zero tolerance CVE violations: {len(zero_tolerance_violations)}")
        
        if critical_count > self.policy.max_critical:
            status = SecurityGateStatus.REJECTED
            reasons.append(f"Critical findings exceed threshold: {critical_count} > {self.policy.max_critical}")
        
        if high_count > self.policy.max_high:
            if status != SecurityGateStatus.REJECTED:
                status = SecurityGateStatus.WARNING
            reasons.append(f"High findings exceed threshold: {high_count} > {self.policy.max_high}")
        
        if medium_count > self.policy.max_medium:
            if status == SecurityGateStatus.APPROVED:
                status = SecurityGateStatus.WARNING
            reasons.append(f"Medium findings exceed threshold: {medium_count} > {self.policy.max_medium}")
        
        return {
            "approved": status == SecurityGateStatus.APPROVED,
            "status": status.value,
            "reasons": reasons,
            "summary": {
                "total_findings": len(self.findings),
                "critical": critical_count,
                "high": high_count,
                "medium": medium_count,
                "low": sum(1 for f in self.findings if f.severity == Severity.LOW)
            },
            "zero_tolerance_violations": len(zero_tolerance_violations),
            "findings": [
                {
                    "id": f.id,
                    "title": f.title,
                    "severity": f.severity.value,
                    "file": f.file_path,
                    "line": f.line_number,
                    "cve": f.cve_id
                }
                for f in self.findings
            ]
        }

def main():
    import argparse
    parser = argparse.ArgumentParser(description='Security Gate Evaluator')
    parser.add_argument('--trivy-results', required=True)
    parser.add_argument('--secrets-scan', required=True)
    parser.add_argument('--dependency-scan', required=True)
    parser.add_argument('--policy', default='.security/gate-policy.yml')
    parser.add_argument('--output', required=True)
    
    args = parser.parse_args()
    
    evaluator = SecurityGateEvaluator(args.policy)
    
    # Add results from different scanners
    if Path(args.trivy_results).exists():
        evaluator.add_trivy_results(args.trivy_results)
    
    if Path(args.secrets_scan).exists():
        evaluator.add_secrets_results(args.secrets_scan)
    
    if Path(args.dependency_scan).exists():
        evaluator.add_dependency_results(args.dependency_scan)
    
    # Evaluate security gate
    result = evaluator.evaluate_security_gate()
    
    # Save results
    with open(args.output, 'w') as f:
        json.dump(result, f, indent=2)
    
    # Print summary
    print(f"Security Gate Status: {result['status'].upper()}")
    print(f"Total Findings: {result['summary']['total_findings']}")
    print(f"Critical: {result['summary']['critical']}")
    print(f"High: {result['summary']['high']}")
    print(f"Medium: {result['summary']['medium']}")
    
    if result['reasons']:
        print("Reasons:")
        for reason in result['reasons']:
            print(f"  - {reason}")
    
    # Exit with appropriate code
    if result['status'] == 'rejected':
        sys.exit(1)
    elif result['status'] == 'warning':
        sys.exit(2)
    else:
        sys.exit(0)

if __name__ == '__main__':
    main()