name: Security Testing

on:
  push:
    branches: [ main, development ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly security scans
    - cron: '0 0 * * 0'

jobs:
  security-tests:
    name: Security Test Suite
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .
          pip install pytest pytest-asyncio pytest-cov
      
      - name: Run security tests
        run: |
          pytest tests/security/ -v --cov=src/canvas_mcp --cov-report=html --cov-report=term
        continue-on-error: true
      
      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        with:
          name: coverage-report
          path: htmlcov/
      
      - name: Generate test summary
        if: always()
        run: |
          echo "## 🔒 Security Test Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Security test suite executed. See artifacts for detailed results." >> $GITHUB_STEP_SUMMARY

  sast-scan:
    name: Static Analysis Security Testing
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install SAST tools
        run: |
          pip install bandit semgrep
      
      - name: Run Bandit scan
        run: |
          bandit -r src/canvas_mcp/ -f json -o bandit-report.json
        continue-on-error: true
      
      - name: Run Semgrep scan
        run: |
          semgrep --config=auto src/ --json -o semgrep-report.json
        continue-on-error: true
      
      - name: Upload SAST results
        uses: actions/upload-artifact@v4
        with:
          name: sast-reports
          path: |
            bandit-report.json
            semgrep-report.json
      
      - name: Generate SAST summary
        if: always()
        run: |
          echo "## 🔍 Static Analysis Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "SAST scanning completed. Review artifacts for findings." >> $GITHUB_STEP_SUMMARY

  dependency-scan:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install -e .
      
      - name: Install scanning tools
        run: |
          pip install pip-audit safety
      
      - name: Run pip-audit
        run: |
          pip-audit --format json --output pip-audit-report.json
        continue-on-error: true
      
      - name: Run Safety check
        run: |
          safety check --json --output safety-report.json
        continue-on-error: true
      
      - name: Upload dependency scan results
        uses: actions/upload-artifact@v4
        with:
          name: dependency-scan-reports
          path: |
            pip-audit-report.json
            safety-report.json
      
      - name: Generate dependency summary
        if: always()
        run: |
          echo "## 📦 Dependency Security Scan" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Dependency vulnerability scanning completed." >> $GITHUB_STEP_SUMMARY

  secret-scan:
    name: Secret Detection Scan
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for secret scanning
      
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.11'
      
      - name: Install secret scanning tools
        run: |
          pip install detect-secrets
      
      - name: Run detect-secrets
        run: |
          detect-secrets scan --all-files --force-use-all-plugins > secrets-baseline.json
        continue-on-error: true
      
      - name: TruffleHog scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: main
          head: HEAD
        continue-on-error: true
      
      - name: Upload secret scan results
        uses: actions/upload-artifact@v4
        with:
          name: secret-scan-reports
          path: secrets-baseline.json
      
      - name: Generate secret scan summary
        if: always()
        run: |
          echo "## 🔐 Secret Detection Scan" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Secret detection scanning completed. Review artifacts for findings." >> $GITHUB_STEP_SUMMARY

  codeql-analysis:
    name: CodeQL Security Analysis
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      actions: read
      contents: read
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: python
          queries: security-and-quality
      
      - name: Autobuild
        uses: github/codeql-action/autobuild@v2
      
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v2
        with:
          category: "/language:python"

  security-summary:
    name: Security Test Summary
    needs: [security-tests, sast-scan, dependency-scan, secret-scan]
    runs-on: ubuntu-latest
    if: always()
    
    steps:
      - name: Generate overall summary
        run: |
          echo "## 🛡️ Security Testing Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "All security testing jobs completed. Please review individual job results and artifacts." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Test Coverage" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Security test suite" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Static analysis (SAST)" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Dependency scanning" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Secret detection" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ CodeQL analysis" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "Review the **Actions** tab artifacts for detailed reports." >> $GITHUB_STEP_SUMMARY
