added code

Author: Gaurav Patil

.github/workflows/security-scan.yml

@@ -2,25 +2,132 @@ name: Security Scan
 
 on:
   push:
-    branches: [ main ]
+    branches: [ main, develop ]
   pull_request:
+    branches: [ main, develop ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  pull-requests: write
+  checks: write
 
 jobs:
   security-scan:
+    name: Security Scan
     runs-on: ubuntu-latest
-
+    
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Make scan script executable
-        run: chmod +x ./scan.sh
-
-      - name: Run security scan
-        run: ./scan.sh
+    - name: Checkout code
+      uses: actions/checkout@v4
+      
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: '1.21'
+        cache: true
+        
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y jq
+        
+    - name: Make script executable
+      run: chmod +x ./scan.sh
+        
+    - name: Run security scan
+      id: scan
+      continue-on-error: true
+      run: |
+        if ./scan.sh; then
+          echo "scan_status=success" >> $GITHUB_OUTPUT
+          echo "scan_result=✅ PASSED" >> $GITHUB_OUTPUT
+        else
+          echo "scan_status=failure" >> $GITHUB_OUTPUT
+          echo "scan_result=❌ FAILED" >> $GITHUB_OUTPUT
+        fi
+        
+    - name: Upload HTML Report
+      if: always()
+      uses: actions/upload-artifact@v4
+      with:
+        name: security-reports
+        path: security-reports/
+        retention-days: 30
+        
+    - name: Upload SARIF to GitHub Security
+      if: always()
+      uses: github/codeql-action/upload-sarif@v3
+      with:
+        sarif_file: security-reports/gosec-*.sarif
+        category: gosec
+      continue-on-error: true
+        
+    - name: Comment on PR
+      if: github.event_name == 'pull_request' && always()
+      uses: actions/github-script@v7
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          const fs = require('fs');
+          const path = require('path');
+          
+          // Find the summary file
+          const reportsDir = 'security-reports';
+          const files = fs.readdirSync(reportsDir);
+          const summaryFile = files.find(f => f === 'SECURITY-SUMMARY.md');
+          
+          if (summaryFile) {
+            const summaryPath = path.join(reportsDir, summaryFile);
+            const summary = fs.readFileSync(summaryPath, 'utf8');
+            
+            // Find existing comment
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+            
+            const botComment = comments.find(comment => 
+              comment.user.type === 'Bot' && 
+              comment.body.includes('Security Scan Report')
+            );
+            
+            const commentBody = `${summary}
 
-      - name: Upload scan report
-        uses: actions/upload-artifact@v4
-        with:
-          name: security-report
-          path: ./report/
+---
+📥 [Download detailed reports](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`;
+            
+            if (botComment) {
+              // Update existing comment
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: commentBody
+              });
+            } else {
+              // Create new comment
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: commentBody
+              });
+            }
+          }
+          
+    - name: Set job summary
+      if: always()
+      run: |
+        if [ -f "security-reports/SECURITY-SUMMARY.md" ]; then
+          cat security-reports/SECURITY-SUMMARY.md >> $GITHUB_STEP_SUMMARY
+        fi
+          
+    - name: Fail if security issues found
+      if: steps.scan.outputs.scan_status == 'failure'
+      run: |
+        echo "::error::❌ Security scan failed - critical issues detected"
+        echo "::error::View the Security tab or download artifacts for details"
+        exit 1