Add detailed security status reporting

modules/security.sh

@@ -1,10 +1,23 @@
 #!/bin/bash
-set -euo pipefail
+set -u
 
 echo "============================"
 echo " Davidson CI - Security"
 echo "============================"
 
+FAIL=0
+
+set_env() {
+    echo "$1=$2" >> "${GITHUB_ENV:-/dev/null}"
+}
+
+# Default states
+set_env "DAVIDSON_COMPOSER_AUDIT" "SKIP"
+set_env "DAVIDSON_NPM_AUDIT" "SKIP"
+set_env "DAVIDSON_SEMGREP" "SKIP"
+set_env "DAVIDSON_TRIVY_VULN" "SKIP"
+set_env "DAVIDSON_TRIVY_SECRET" "SKIP"
+
 # -------------------------
 # Composer audit
 # -------------------------
@@ -13,9 +26,14 @@ echo
 echo "→ Composer security audit"
 
 if [ -f composer.lock ]; then
-    composer audit
+    if composer audit; then
+        set_env "DAVIDSON_COMPOSER_AUDIT" "PASS"
     else
-    echo "No composer.lock - skipping Composer audit"
+        set_env "DAVIDSON_COMPOSER_AUDIT" "FAIL"
+        FAIL=1
+    fi
+else
+    echo "No composer.lock - skipping"
 fi
 
 # -------------------------
@@ -26,9 +44,14 @@ echo
 echo "→ npm security audit"
 
 if [ -f package-lock.json ]; then
-    npm audit --audit-level=high
+    if npm audit --audit-level=high; then
+        set_env "DAVIDSON_NPM_AUDIT" "PASS"
     else
-    echo "No package-lock.json - skipping npm audit"
+        set_env "DAVIDSON_NPM_AUDIT" "FAIL"
+        FAIL=1
+    fi
+else
+    echo "No package-lock.json - skipping"
 fi
 
 # -------------------------
@@ -38,39 +61,72 @@ fi
 echo
 echo "→ Semgrep"
 
-semgrep scan \
+if semgrep scan \
     --config=p/security-audit \
     --error \
     --exclude=node_modules \
     --exclude=vendor \
     .
+then
+    set_env "DAVIDSON_SEMGREP" "PASS"
+else
+    set_env "DAVIDSON_SEMGREP" "FAIL"
+    FAIL=1
+fi
 
 # -------------------------
-# Trivy vulnerability scan
+# Trivy vulnerabilities
 # -------------------------
 
 echo
 echo "→ Trivy vulnerabilities"
 
-trivy fs \
+if trivy fs \
     --scanners vuln \
     --severity HIGH,CRITICAL \
     --exit-code 1 \
     --no-progress \
     .
+then
+    set_env "DAVIDSON_TRIVY_VULN" "PASS"
+else
+    set_env "DAVIDSON_TRIVY_VULN" "FAIL"
+    FAIL=1
+fi
 
 # -------------------------
-# Trivy secret scan
+# Trivy secrets
 # -------------------------
 
 echo
 echo "→ Trivy secrets"
 
-trivy fs \
+if trivy fs \
     --scanners secret \
     --exit-code 1 \
     --no-progress \
     .
+then
+    set_env "DAVIDSON_TRIVY_SECRET" "PASS"
+else
+    set_env "DAVIDSON_TRIVY_SECRET" "FAIL"
+    FAIL=1
+fi
+
+# -------------------------
+# Overall result
+# -------------------------
+
+if [ "$FAIL" -eq 0 ]; then
+    set_env "DAVIDSON_SECURITY_STATUS" "PASS"
 
     echo
     echo "Security module completed successfully"
+    exit 0
+else
+    set_env "DAVIDSON_SECURITY_STATUS" "FAIL"
+
+    echo
+    echo "Security module found issues"
+    exit 1
+fi