#!/bin/bash
set -u

echo "============================"
echo " Davidson CI - Security"
echo "============================"

FAIL=0

set_env() {
    echo "$1=$2" >> "${GITHUB_ENV:-/dev/null}"
}

# Default states
set_env "DAVIDSON_COMPOSER_AUDIT" "SKIP"
set_env "DAVIDSON_NPM_AUDIT" "SKIP"
set_env "DAVIDSON_SEMGREP" "SKIP"
set_env "DAVIDSON_TRIVY_VULN" "SKIP"
set_env "DAVIDSON_TRIVY_SECRET" "SKIP"

# -------------------------
# Composer audit
# -------------------------

echo
echo "→ Composer security audit"

if [ -f composer.lock ]; then
    if composer audit; then
        set_env "DAVIDSON_COMPOSER_AUDIT" "PASS"
    else
        set_env "DAVIDSON_COMPOSER_AUDIT" "FAIL"
        FAIL=1
    fi
else
    echo "No composer.lock - skipping"
fi

# -------------------------
# npm audit
# -------------------------

echo
echo "→ npm security audit"

if [ -f package-lock.json ]; then
    if npm audit --audit-level=high; then
        set_env "DAVIDSON_NPM_AUDIT" "PASS"
    else
        set_env "DAVIDSON_NPM_AUDIT" "FAIL"
        FAIL=1
    fi
else
    echo "No package-lock.json - skipping"
fi

# -------------------------
# Semgrep
# -------------------------

echo
echo "→ Semgrep"

if semgrep scan \
    --config=p/security-audit \
    --config=.davidson-ci/semgrep/davidson.yml \
    --error \
    --exclude=node_modules \
    --exclude=vendor \
    .
then
    set_env "DAVIDSON_SEMGREP" "PASS"
else
    set_env "DAVIDSON_SEMGREP" "FAIL"
    FAIL=1
fi

# -------------------------
# Trivy vulnerabilities
# -------------------------

echo
echo "→ Trivy vulnerabilities"

if trivy fs \
    --scanners vuln \
    --severity HIGH,CRITICAL \
    --exit-code 1 \
    --no-progress \
    .
then
    set_env "DAVIDSON_TRIVY_VULN" "PASS"
else
    set_env "DAVIDSON_TRIVY_VULN" "FAIL"
    FAIL=1
fi

# -------------------------
# Trivy secrets
# -------------------------

echo
echo "→ Trivy secrets"

if trivy fs \
    --scanners secret \
    --exit-code 1 \
    --no-progress \
    .
then
    set_env "DAVIDSON_TRIVY_SECRET" "PASS"
else
    set_env "DAVIDSON_TRIVY_SECRET" "FAIL"
    FAIL=1
fi

# -------------------------
# Overall result
# -------------------------

if [ "$FAIL" -eq 0 ]; then
    set_env "DAVIDSON_SECURITY_STATUS" "PASS"

    echo
    echo "Security module completed successfully"
    exit 0
else
    set_env "DAVIDSON_SECURITY_STATUS" "FAIL"

    echo
    echo "Security module found issues"
    exit 1
fi