#!/bin/bash
set -euo pipefail

echo "============================"
echo " Davidson CI - Security"
echo "============================"

# -------------------------
# Composer audit
# -------------------------

echo
echo "→ Composer security audit"

if [ -f composer.lock ]; then
    composer audit
else
    echo "No composer.lock - skipping Composer audit"
fi

# -------------------------
# npm audit
# -------------------------

echo
echo "→ npm security audit"

if [ -f package-lock.json ]; then
    npm audit --audit-level=high
else
    echo "No package-lock.json - skipping npm audit"
fi

# -------------------------
# Semgrep
# -------------------------

echo
echo "→ Semgrep"

semgrep scan \
    --config=p/security-audit \
    --error \
    --exclude=node_modules \
    --exclude=vendor \
    .

# -------------------------
# Trivy vulnerability scan
# -------------------------

echo
echo "→ Trivy vulnerabilities"

trivy fs \
    --scanners vuln \
    --severity HIGH,CRITICAL \
    --exit-code 1 \
    --no-progress \
    .

# -------------------------
# Trivy secret scan
# -------------------------

echo
echo "→ Trivy secrets"

trivy fs \
    --scanners secret \
    --exit-code 1 \
    --no-progress \
    .

echo
echo "Security module completed successfully"