ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write

jobs:
  # ── Lint + static analysis ──────────────────────────────────────
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: ruff
      - run: ruff check skills/ tests/ mcp-server/ scripts/ --config pyproject.toml

  skill-contract:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
      - run: python scripts/validate_skill_contract.py
      - run: python scripts/validate_skill_integrity.py
      - run: python scripts/validate_dependency_consistency.py
      - run: python scripts/validate_framework_coverage.py
      - run: python scripts/validate_ocsf_metadata.py

  safe-skill-bar:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: bandit pip-audit
      - run: python scripts/validate_safe_skill_bar.py
      - name: Check for hardcoded secrets
        run: |
          ! grep -rn "AKIA[A-Z0-9]\{16\}" skills/*/*/src/ mcp-server/src/ scripts/ --include="*.py" || exit 1
          ! grep -rn "sk-[a-zA-Z0-9]\{20,\}" skills/*/*/src/ mcp-server/src/ scripts/ --include="*.py" || exit 1
          ! grep -rn "ghp_[a-zA-Z0-9]\{36\}" skills/*/*/src/ mcp-server/src/ scripts/ --include="*.py" || exit 1
          echo "No hardcoded secrets found in enforced executable paths"
      - name: Dependency vulnerability audit
        run: pip-audit "${{ github.workspace }}"

  security-scan:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: bandit
      - run: bandit -r skills/evaluation/cspm-aws-cis-benchmark skills/remediation/iam-departures-remediation mcp-server -c pyproject.toml --severity-level medium

  # ── Unit tests, grouped into category lanes ───────────────────
  test-compliance:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: >-
            boto3 moto pytest pytest-cov
            google-cloud-compute google-cloud-iam google-cloud-resource-manager google-cloud-storage
            azure-identity azure-mgmt-network azure-mgmt-resource azure-mgmt-storage
      - name: Run compliance skill suites
        shell: bash
        run: |
          set -euo pipefail
          for skill in \
            cspm-aws-cis-benchmark \
            cspm-gcp-cis-benchmark \
            cspm-azure-cis-benchmark \
            k8s-security-benchmark \
            container-security
          do
            echo "==> skills/evaluation/${skill}"
            pytest "skills/evaluation/${skill}/tests/" -v -o "testpaths=tests"
          done

  test-remediation:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: >-
            boto3 moto pytest pytest-cov
            google-cloud-iam google-cloud-resource-manager google-api-python-client
            azure-identity
            clickhouse-connect databricks-sql-connector httpx snowflake-connector-python
      - run: pytest skills/remediation/iam-departures-remediation/tests/ -v -o "testpaths=tests"

  test-detection-engineering:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: pytest pytest-cov
      - name: Run ingestion, detection, and view suites
        shell: bash
        run: |
          set -euo pipefail
          for skill_dir in \
            skills/ingestion/ingest-cloudtrail-ocsf \
            skills/ingestion/ingest-vpc-flow-logs-ocsf \
            skills/ingestion/ingest-vpc-flow-logs-gcp-ocsf \
            skills/ingestion/ingest-nsg-flow-logs-azure-ocsf \
            skills/ingestion/ingest-guardduty-ocsf \
            skills/ingestion/ingest-security-hub-ocsf \
            skills/ingestion/ingest-gcp-scc-ocsf \
            skills/ingestion/ingest-azure-defender-for-cloud-ocsf \
            skills/ingestion/ingest-gcp-audit-ocsf \
            skills/ingestion/ingest-azure-activity-ocsf \
            skills/ingestion/ingest-entra-directory-audit-ocsf \
            skills/ingestion/ingest-okta-system-log-ocsf \
            skills/ingestion/ingest-google-workspace-login-ocsf \
            skills/ingestion/ingest-k8s-audit-ocsf \
            skills/ingestion/ingest-mcp-proxy-ocsf \
            skills/detection/detect-mcp-tool-drift \
            skills/detection/detect-okta-mfa-fatigue \
            skills/detection/detect-google-workspace-suspicious-login \
            skills/detection/detect-privilege-escalation-k8s \
            skills/detection/detect-sensitive-secret-read-k8s \
            skills/detection/detect-lateral-movement \
            skills/view/convert-ocsf-to-sarif \
            skills/view/convert-ocsf-to-mermaid-attack-flow
          do
            echo "==> ${skill_dir}"
            pytest "${skill_dir}/tests/" -v -o "testpaths=tests"
          done

  test-ai-infra-security:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    name: test-ai-infra
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: >-
            boto3 pytest pytest-cov
            google-cloud-compute google-cloud-iam google-cloud-resource-manager google-cloud-storage
            azure-identity azure-mgmt-resource
      - name: Run discovery and AI infra skill suites
        shell: bash
        run: |
          set -euo pipefail
          for skill_dir in \
            skills/discovery/discover-environment \
            skills/discovery/discover-ai-bom \
            skills/discovery/discover-control-evidence \
            skills/discovery/discover-cloud-control-evidence \
            skills/evaluation/model-serving-security \
            skills/evaluation/gpu-cluster-security
          do
            echo "==> ${skill_dir}"
            pytest "${skill_dir}/tests/" -v -o "testpaths=tests"
          done

  test-integration:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: pytest pytest-cov
      - run: pytest tests/integration/ mcp-server/tests/ -v -o "testpaths=tests"

  # ── IaC validation (CloudFormation + Terraform in one job) ─────
  validate-iac:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: cfn-lint
      - uses: hashicorp/setup-terraform@v4
        with:
          terraform_version: "1.12.0"
      - name: cfn-lint — CloudFormation
        run: |
          cfn-lint skills/remediation/iam-departures-remediation/infra/cloudformation.yaml
          cfn-lint skills/remediation/iam-departures-remediation/infra/cross_account_stackset.yaml
      - name: terraform validate
        run: cd skills/remediation/iam-departures-remediation/infra/terraform && terraform init -backend=false && terraform validate

  # ── agent-bom scans (code + skills + fs + IaC with SARIF upload) ─
  agent-bom:
    runs-on: ubuntu-latest
    needs: [lint, skill-contract, safe-skill-bar]
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/setup-python-deps
        with:
          python-version: "3.11"
          packages: agent-bom
      - name: Scan code for AI components
        run: agent-bom code skills/ -f json -o code-scan.json || true
      - name: Audit skill definitions
        run: agent-bom skills scan skills/ -f json -o skills-audit.json --verbose || true
      - name: Scan filesystem for packages and CVEs
        run: agent-bom fs skills/ -f json -o fs-scan.json || true
      - name: Scan IaC (CloudFormation + Terraform)
        run: |
          agent-bom iac \
            skills/remediation/iam-departures-remediation/infra/cloudformation.yaml \
            skills/remediation/iam-departures-remediation/infra/cross_account_stackset.yaml \
            skills/remediation/iam-departures-remediation/infra/terraform/main.tf \
            -f json -o iac-scan.json || true
      - name: Scan IaC (SARIF for code scanning)
        run: |
          agent-bom iac \
            skills/remediation/iam-departures-remediation/infra/cloudformation.yaml \
            skills/remediation/iam-departures-remediation/infra/cross_account_stackset.yaml \
            skills/remediation/iam-departures-remediation/infra/terraform/main.tf \
            -f sarif -o iac-scan.sarif || true
      - name: Normalise SARIF (handle agent-bom empty-result quirk)
        if: always()
        run: |
          python3 - <<'PY'
          import json, os
          path = "iac-scan.sarif"
          stub = {
              "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
              "version": "2.1.0",
              "runs": [{
                  "tool": {"driver": {"name": "agent-bom-iac", "version": "0.76.2", "informationUri": "https://github.com/msaad00/agent-bom"}},
                  "results": []
              }]
          }
          if not os.path.exists(path):
              json.dump(stub, open(path, "w"))
              print("wrote stub SARIF (file missing)")
          else:
              try:
                  doc = json.load(open(path))
              except Exception as e:
                  json.dump(stub, open(path, "w"))
                  print(f"wrote stub SARIF (json parse failed: {e})")
              else:
                  if not (isinstance(doc, dict) and "runs" in doc):
                      json.dump(stub, open(path, "w"))
                      print("wrote stub SARIF (not SARIF-shaped)")
                  else:
                      print(f"SARIF ok: {len(doc.get('runs', []))} runs")
          PY
      - name: Upload IaC SARIF to GitHub code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: iac-scan.sarif
          category: agent-bom-iac
        continue-on-error: true
      - name: Upload scan artifacts
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: agent-bom-results
          path: |
            code-scan.json
            skills-audit.json
            fs-scan.json
            iac-scan.json
            iac-scan.sarif
          if-no-files-found: ignore