name: Security Scan

on:
  push:
    branches:
      - main
      - develop
    paths:
      - 'k8s/**'
  pull_request:
    paths:
      - 'k8s/**'

jobs:
  security:
    runs-on: docker
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Tools
        run: |
          apt-get update && apt-get install -y \
            python3-pip \
            curl

          # Install Trivy (vulnerability scanner)
          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin

          # Install Polaris (K8s security audit)
          curl -L https://github.com/FairwindsOps/polaris/releases/latest/download/polaris-linux-amd64 -o /usr/local/bin/polaris
          chmod +x /usr/local/bin/polaris

      - name: Trivy - Scan Dockerfile (if present)
        run: |
          if find . -name "Dockerfile" 2>/dev/null | grep -v node_modules | head -1 | grep -q .; then
            echo "=== Scanning Dockerfiles with Trivy ==="
            find . -name "Dockerfile" -not -path "*/node_modules/*" -exec trivy config {} \;
          else
            echo "No Dockerfiles found"
          fi

      - name: Trivy - Scan Helm Charts
        run: |
          if find k8s -name "Chart.yaml" 2>/dev/null | head -1 | grep -q .; then
            echo "=== Scanning Helm charts with Trivy ==="
            find k8s -name "Chart.yaml" -exec dirname {} \; | while read chart; do
              echo "Scanning $chart..."
              trivy config "$chart" || true
            done
          else
            echo "No Helm charts found"
          fi

      - name: Polaris - K8s Security Audit
        run: |
          echo "=== Running Polaris K8s security audit ==="
          polaris audit --audit-path /tmp/polaris-audit.json k8s/ || true

          if [ -f /tmp/polaris-audit.json ]; then
            echo "Security issues found:"
            jq '.results[] | select(.pass == false)' /tmp/polaris-audit.json || true
          fi

      - name: Check for Secrets in Code
        run: |
          echo "=== Scanning for hardcoded secrets ==="
          SECRETS_FOUND=0

          # Check for common secret patterns
          for pattern in "password:" "secret:" "token:" "api_key:" "apikey:" "private_key:" "privatekey:"; do
            if grep -r "$pattern" k8s/ --include="*.yaml" --include="*.yml" | grep -v "^Binary"; then
              echo "⚠️  Found potential secret pattern: $pattern"
              SECRETS_FOUND=$((SECRETS_FOUND + 1))
            fi
          done

          if [ $SECRETS_FOUND -gt 0 ]; then
            echo "⚠️  Warning: Found $SECRETS_FOUND potential secrets"
            echo "Secrets should be encrypted with SOPS or stored in ArgoCD Sealed Secrets"
          else
            echo "✓ No hardcoded secrets found"
          fi

      - name: Check for Security Best Practices
        run: |
          echo "=== Checking K8s security best practices ==="

          # Check for privileged containers
          if grep -r "privileged: true" k8s/ --include="*.yaml" --include="*.yml"; then
            echo "⚠️  Found privileged containers"
          fi

          # Check for hostNetwork
          if grep -r "hostNetwork: true" k8s/ --include="*.yaml" --include="*.yml"; then
            echo "⚠️  Found hostNetwork usage"
          fi

          # Check for missing resource limits
          echo "Checking for missing resource requests/limits..."
          MISSING=0
          find k8s -name "*.yaml" -o -name "*.yml" | while read file; do
            if grep -q "kind: Deployment\|kind: StatefulSet\|kind: DaemonSet" "$file"; then
              if ! grep -q "resources:" "$file"; then
                echo "⚠️  $file: Missing resource requests/limits"
                MISSING=$((MISSING + 1))
              fi
            fi
          done

      - name: Summary
        if: always()
        run: |
          echo "=== Security Scan Summary ==="
          echo "✓ Dockerfiles scanned"
          echo "✓ Helm charts scanned"
          echo "✓ K8s manifests audited"
          echo "✓ Secrets check completed"
          echo "✓ Best practices verified"