ci-devsecops.yml

name: CI DevSecOps (build, tests y SAST)

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]
  workflow_dispatch:

# Permisos mínimos necesarios; security-events:write permite subir SARIF a Code Scanning
permissions:
  contents: read
  security-events: write
  actions: read

jobs:
  # 1) Construcción + pruebas unitarias
  build-test:
    name: Build & Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configurar Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Instalar dependencias
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements-dev.txt

      - name: Ejecutar pruebas (pytest)
        run: pytest -q

  # 2) SAST principal: CodeQL (motor nativo de GitHub, resultados en la pestaña Security)
  codeql:
    name: SAST - CodeQL
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Inicializar CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: python
          queries: security-extended

      - name: Analizar con CodeQL
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:python"

  # 3) Segundo SAST: Semgrep (genera SARIF como ARTEFACTO descargable + Code Scanning)
  semgrep:
    name: SAST - Semgrep
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    container:
      image: semgrep/semgrep
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Escanear con Semgrep (SARIF)
        continue-on-error: true
        run: |
          semgrep scan \
            --config=p/default \
            --config=p/python \
            --config=p/security-audit \
            --config=.semgrep.yml \
            --sarif --output semgrep.sarif \
            --metrics=off

      - name: Reporte legible de Semgrep (texto)
        continue-on-error: true
        run: |
          semgrep scan \
            --config=p/default --config=p/python --config=p/security-audit --config=.semgrep.yml \
            --metrics=off | tee semgrep-report.txt

      - name: Subir artefacto SAST (retroalimentación de la herramienta)
        uses: actions/upload-artifact@v4
        with:
          name: semgrep-sast-report
          path: |
            semgrep.sarif
            semgrep-report.txt

      - name: Subir SARIF a Code Scanning
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: semgrep.sarif
          category: semgrep

  # 4) Tercer SAST (Python): Bandit -> reporte como ARTEFACTO descargable
  bandit:
    name: SAST - Bandit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Configurar Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Instalar Bandit
        run: pip install bandit
      - name: Ejecutar Bandit (SAST)
        continue-on-error: true
        run: |
          bandit -r app/ -f txt  -o bandit-report.txt  || true
          bandit -r app/ -f json -o bandit-report.json || true
      - name: Subir artefacto SAST (Bandit)
        uses: actions/upload-artifact@v4
        with:
          name: bandit-sast-report
          path: |
            bandit-report.txt
            bandit-report.json

  # 5) Bonus DevSecOps: escaneo de secretos con GitLeaks
  gitleaks:
    name: Secret Scanning - GitLeaks
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: GitLeaks
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # 6) Generación de ARTEFACTO: imagen Docker + SBOM + attestation de procedencia (integridad)
  build-image:
    name: Artefacto - Imagen + SBOM + Attestation
    runs-on: ubuntu-latest
    needs: build-test
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login a GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build & push (con SBOM y provenance del artefacto)
        id: build
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |
            ghcr.io/stevencarrilloloor/securetask-api:latest
            ghcr.io/stevencarrilloloor/securetask-api:${{ github.sha }}
          sbom: true
          provenance: mode=max
      - name: Generar SBOM (SPDX) como artefacto
        uses: anchore/sbom-action@v0
        with:
          path: .
          format: spdx-json
          output-file: sbom.spdx.json
      - name: Subir SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom-spdx
          path: sbom.spdx.json
      - name: Attestation de procedencia del build (SLSA)
        uses: actions/attest-build-provenance@v2
        with:
          subject-name: ghcr.io/stevencarrilloloor/securetask-api
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

  # 7) Despliegue en un cluster KUBERNETES real (kind) con estrategia rolling update
  deploy-k8s:
    name: Deploy Kubernetes (kind)
    runs-on: ubuntu-latest
    needs: build-test
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Crear cluster kind
        uses: helm/kind-action@v1
      - name: Construir imagen
        run: docker build -t securetask-api:ci .
      - name: Cargar imagen en kind
        run: kind load docker-image securetask-api:ci --name chart-testing
      - name: Aplicar manifiestos (rolling update)
        run: |
          kubectl apply -f k8s/namespace.yaml
          kubectl apply -f k8s/secret.yaml
          kubectl apply -f k8s/deployment.yaml
          kubectl apply -f k8s/service.yaml
          kubectl -n securetask rollout status deployment/securetask-api --timeout=150s
      - name: Verificar despliegue
        run: |
          kubectl -n securetask get deploy,svc,pods -o wide
      - name: Smoke test (/health)
        run: |
          kubectl -n securetask port-forward svc/securetask-api 8080:80 &
          sleep 6
          curl -sf http://localhost:8080/health && echo "  -> Health OK"
      - name: Demostrar ROLLING UPDATE sin downtime
        run: |
          kubectl -n securetask rollout restart deployment/securetask-api
          kubectl -n securetask rollout status deployment/securetask-api --timeout=120s
          kubectl -n securetask rollout history deployment/securetask-api

  # 8) DAST: análisis dinámico de seguridad con OWASP ZAP contra la app en ejecución
  dast:
    name: DAST - OWASP ZAP
    runs-on: ubuntu-latest
    needs: build-test
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Construir imagen
        run: docker build -t securetask-api:dast .
      - name: Levantar app y escanear con ZAP
        run: |
          mkdir -p dast && chmod 777 dast
          docker network create zapnet
          docker run -d --name app --network zapnet -e SECRET_KEY=ci-dast securetask-api:dast
          sleep 12
          docker run --rm --network zapnet -v "${{ github.workspace }}/dast:/zap/wrk/:rw" \
            ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
            -t http://app:8000 -r zap-report.html -w zap-report.md || true
      - name: Subir reporte DAST (artefacto)
        uses: actions/upload-artifact@v4
        with:
          name: dast-zap-report
          path: dast/