security.yml

name: Security & MSRV

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run security audit daily at 2 AM UTC
    - cron: '0 2 * * *'

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && github.run_id || github.ref }}
  cancel-in-progress: ${{ github.event_name != 'schedule' }}

env:
  CARGO_TERM_COLOR: always

jobs:
  msrv-check:
    name: Minimum Supported Rust Version
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v4

    - name: Install MSRV Rust
      uses: dtolnay/rust-toolchain@master
      with:
        toolchain: 1.92.0  # Flight Hub MSRV

    - name: Cache cargo registry
      uses: actions/cache@v4
      with:
        path: |
          ~/.cargo/registry
          ~/.cargo/git
          target
        key: msrv-${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

    - name: Install Linux HID build deps
      run: |
        sudo apt-get update
        sudo apt-get install -y libudev-dev

    - name: Check MSRV compilation
      run: |
        echo "🦀 Testing compilation with Rust 1.92.0 (MSRV)"
        cargo check --workspace --all-targets
        echo "✅ MSRV check passed"

  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
    - uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-audit
      run: cargo +stable install --locked cargo-audit

    - name: Install cargo-deny
      run: cargo +stable install --locked cargo-deny

    - name: Run security audit
      run: |
        echo "🔒 Running security audit"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo audit --deny warnings || echo "::warning::Security audit reported issues (report-only on pull_request)."
        else
          cargo audit --deny warnings
        fi
        echo "✅ Security audit passed"

    - name: Run cargo-deny
      run: |
        echo "🚫 Running cargo-deny checks"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo deny check --hide-inclusion-graph || echo "::warning::cargo-deny reported issues (report-only on pull_request)."
        else
          cargo deny check --hide-inclusion-graph
        fi
        echo "✅ Cargo-deny checks passed"

  license-check:
    name: License Compliance
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
    - uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-deny
      run: cargo +stable install --locked cargo-deny

    - name: Check licenses
      run: |
        echo "📄 Checking license compliance"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo deny check licenses || echo "::warning::License check reported issues (report-only on pull_request)."
        else
          cargo deny check licenses
        fi
        echo "✅ License check passed"

    - name: Generate license report
      run: |
        echo "📋 Generating license report"
        cargo deny list --format json > licenses.json

        echo "## 📄 License Report" >> $GITHUB_STEP_SUMMARY
        echo "| Crate | License | Version |" >> $GITHUB_STEP_SUMMARY
        echo "|-------|---------|---------|" >> $GITHUB_STEP_SUMMARY

        # Parse JSON and create markdown table (simplified)
        echo "License report generated in licenses.json"

  supply-chain:
    name: Supply Chain Security
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
    - uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install nightly for scripts (no default switch)
      run: rustup toolchain install nightly --profile minimal --no-self-update

    - name: Install audit tools
      run: |
        echo "🛠️ Installing supply chain audit tools"
        cargo +stable install --locked cargo-audit cargo-deny cargo-license
        echo "✅ Audit tools installed"

    - name: Run comprehensive supply chain audit
      run: |
        echo "🔍 Running comprehensive supply chain audit"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo +nightly -Zscript scripts/supply_chain_audit.rs || echo "::warning::Supply-chain audit script reported issues (report-only on pull_request)."
        else
          cargo +nightly -Zscript scripts/supply_chain_audit.rs
        fi
        echo "✅ Supply chain audit completed"

    - name: Upload audit artifacts
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: supply-chain-audit-${{ github.sha }}
        path: |
          SUPPLY_CHAIN_AUDIT.md
          THIRD_PARTY_LICENSES.md
          spdx/
        retention-days: 30

    - name: Check for banned crates
      run: |
        echo "🔍 Checking for banned/vulnerable crates"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo deny check bans || echo "::warning::Banned crate check reported issues (report-only on pull_request)."
        else
          cargo deny check bans
        fi
        echo "✅ Supply chain check passed"

    - name: Check for duplicate dependencies
      run: |
        echo "🔍 Checking for duplicate dependencies"
        cargo tree --duplicates
        echo "ℹ️ Duplicate dependency check completed"

    - name: Validate SPDX documents
      run: |
        echo "📋 Validating SPDX documents"
        if [ -d "spdx" ]; then
          for spdx_file in spdx/*.spdx; do
            if [ -f "$spdx_file" ]; then
              echo "  Validating $(basename "$spdx_file")"
              # Basic SPDX validation - check required fields
              if grep -q "SPDXVersion:" "$spdx_file" && \
                 grep -q "DataLicense:" "$spdx_file" && \
                 grep -q "PackageName:" "$spdx_file"; then
                echo "    ✅ $(basename "$spdx_file") is valid"
              else
                echo "    ❌ $(basename "$spdx_file") is invalid"
                exit 1
              fi
            fi
          done
        fi
        echo "✅ SPDX validation completed"

  semver-check:
    name: Semantic Versioning
    runs-on: ubuntu-latest
    timeout-minutes: 20
    if: github.event_name == 'pull_request'
    steps:
    - uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Need full history for semver check

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Install cargo-semver-checks
      run: cargo +stable install --locked cargo-semver-checks

    - name: Check semantic versioning
      run: |
        echo "📦 Checking semantic versioning compliance"
        # Check each public crate for breaking changes
        for crate in flight-core flight-scheduler flight-virtual; do
          echo "Checking $crate..."
          cargo semver-checks check-release --package $crate || echo "⚠️ Breaking changes detected in $crate"
        done
        echo "✅ Semver check completed"

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: github.event_name == 'pull_request'
    steps:
    - name: Dependency Review
      id: dependency_review
      continue-on-error: true
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: moderate
        allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC

    - name: Note unavailable dependency review
      if: steps.dependency_review.outcome != 'success'
      run: echo "::warning::Dependency review is unavailable for this repository configuration."

  supply-chain-gate:
    name: Supply Chain Security Gate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    needs: [security-audit, license-check, supply-chain]
    steps:
    - uses: actions/checkout@v4

    - name: Install Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: clippy

    - name: Install nightly for scripts (no default switch)
      run: rustup toolchain install nightly --profile minimal --no-self-update

    - name: Install audit tools
      run: |
        cargo +stable install --locked cargo-audit cargo-deny cargo-license

    - name: Run CI Supply Chain Security Gate
      run: |
        echo "🚪 Running CI Supply Chain Security Gate"
        if [ "${{ github.event_name }}" = "pull_request" ]; then
          cargo +nightly -Zscript scripts/ci_supply_chain_gate.rs || echo "::warning::Supply-chain security gate reported issues (report-only on pull_request)."
        else
          cargo +nightly -Zscript scripts/ci_supply_chain_gate.rs
        fi
        echo "✅ All supply chain security gates passed"

    - name: Upload gate results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: supply-chain-gate-results-${{ github.sha }}
        path: |
          SUPPLY_CHAIN_AUDIT.md
          THIRD_PARTY_LICENSES.md
          spdx/
        retention-days: 90