ANTOS

name: ANTOS Security Pipeline
on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  workflow_dispatch:

permissions:
  contents: read
  security-events: write

jobs:
  # ── Stage 1: Plan ──────────────────────────────────
  plan:
    name: "Plan — Threat Model Validation"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Validate Mermaid diagrams
        run: |
          npm install -g @mermaid-js/mermaid-cli
          find . -name "*.mmd" -exec mmdc -i {} -o /dev/null \;
          echo "✓ All Mermaid diagrams are valid"

      - name: Check threat model docs exist
        run: |
          if [ -d "docs/threat-models" ] || [ -d "arch" ]; then
            echo "✓ Threat model directory found"
          else
            echo "ℹ No threat model docs yet — consider adding arch/ or docs/threat-models/"
          fi

  # ── Stage 2: Code ──────────────────────────────────
  code:
    name: "Code — SAST + Secret Detection"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Semgrep SAST scan
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/typescript
            p/react
        env:
          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Gitleaks secret detection
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # ── Stage 3: Build ─────────────────────────────────
  build:
    name: "Build — Compile + Audit"
    runs-on: ubuntu-latest
    needs: [code]
    defaults:
      run:
        working-directory: ui-app
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: ui-app/package-lock.json

      - name: Install dependencies
        run: npm ci

      - name: npm audit (production)
        run: npm audit --production --audit-level=high || true

      - name: Build application
        run: npm run build

  # ── Stage 5: Release ───────────────────────────────
  release:
    name: "Release — Image Scan + SBOM"
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: |
          docker build -t antos-ui:ci -f ui-app/Dockerfile ui-app/

      - name: Trivy container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: antos-ui:ci
          format: table
          severity: HIGH,CRITICAL
          exit-code: 0

      - name: Syft SBOM generation
        uses: anchore/sbom-action@v0
        with:
          image: antos-ui:ci
          format: cyclonedx-json
          output-file: sbom.json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

      # Cosign signing — uncomment when pushing to a container registry
      # - name: Cosign sign image
      #   uses: sigstore/cosign-installer@v3
      # - run: cosign sign --yes antos-ui:ci

  # ── Stage 6: Deploy ────────────────────────────────
  deploy:
    name: "Deploy — IaC + Policy Scan"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Checkov IaC scan
        uses: bridgecrewio/checkov-action@v12
        with:
          directory: .
          framework: dockerfile,github_actions
          quiet: true
          soft_fail: true

  # ── Security extras ────────────────────────────────
  security:
    name: "Security — Policy + Detection Rules"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install OPA
        run: |
          curl -sSL -o opa https://openpolicyagent.org/downloads/latest/opa_linux_amd64_static
          chmod +x opa
          sudo mv opa /usr/local/bin/

      - name: Validate Rego policies
        run: |
          if [ -d "policies" ]; then
            opa check policies/
            echo "✓ All Rego policies are valid"
          else
            echo "ℹ No policies/ directory — consider adding OPA/Rego policies"
          fi

      - name: Validate Sigma rules
        run: |
          pip install sigma-cli
          if [ -d "rules/sigma" ]; then
            sigma check rules/sigma/
            echo "✓ All Sigma rules are valid"
          else
            echo "ℹ No rules/sigma/ directory — consider adding Sigma detection rules"
          fi

  # ── Stages 7-8: Runtime (not CI) ───────────────────
  # Operate & Monitor are runtime concerns, not CI jobs.
  # In production these are handled by:
  #   - Microsoft Sentinel (SIEM + KQL analytics)
  #   - Wiz (CNAPP + runtime threat detection)
  #   - ServiceNow (incident management + CMDB)
  #   - Defender for Cloud (CSPM + secure score)
  #   - AWS SecurityHub (compliance standards)
  # Claude orchestrates across all of these continuously.