Add security scanning to Davidson CI

2026-09-08 16:10:03 +01:00
parent 4e300c6bfc
commit 401e15151f
1 changed files with 49 additions and 0 deletions
@@ -129,3 +129,52 @@ jobs:

      - name: Complete
        run: echo "Davidson CI completed successfully"
+       
+           # -------------------------
+      # Security
+      # -------------------------
+
+      - name: Composer security audit
+        run: |
+          if [ -f composer.lock ]; then
+            echo "Running Composer security audit..."
+            composer audit
+          else
+            echo "No composer.lock - skipping Composer audit"
+          fi
+
+      - name: npm security audit
+        run: |
+          if [ -f package-lock.json ]; then
+            echo "Running npm security audit..."
+            npm audit --audit-level=high
+          else
+            echo "No package-lock.json - skipping npm audit"
+          fi
+
+      - name: Semgrep security scan
+        run: |
+          echo "Running Semgrep..."
+          semgrep scan \
+            --config=p/security-audit \
+            --error \
+            --exclude=node_modules \
+            --exclude=vendor \
+            .
+
+      - name: Trivy vulnerability scan
+        run: |
+          echo "Running Trivy vulnerability scan..."
+          trivy fs \
+            --scanners vuln \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            .
+
+      - name: Trivy secret scan
+        run: |
+          echo "Running Trivy secret scan..."
+          trivy fs \
+            --scanners secret \
+            --exit-code 1 \
+            .