security.yml

name: security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  # Gating race-test job, dedicated to the security workflow so it can be a
  # required status check independent of the coverage job in ci.yml.
  race-test:
    name: go test -race
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
      - name: go test -race ./...
        run: go test -race ./...

  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: go
      - name: Autobuild
        uses: github/codeql-action/autobuild@v4
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4
        with:
          category: "/language:go"

  gosec:
    name: gosec (badgeverify)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
      # Scoped to the crown-jewel badge crypto. The rest of the module
      # carries pre-existing G104 findings (unhandled Close()/Set() errors)
      # tracked as follow-up; scoping keeps this gate meaningful and green
      # without rewriting unrelated packages in this PR.
      - name: gosec
        run: go run github.com/securego/gosec/v2/cmd/gosec@v2.22.5 -fmt=text ./badgeverify/...

  govulncheck:
    name: govulncheck
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
      - name: govulncheck
        run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...

  gitleaks:
    name: gitleaks
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      # The gitleaks GitHub Action requires a paid GITLEAKS_LICENSE secret on
      # organization repos. The gitleaks CLI itself is OSS and unrestricted,
      # so we run the pinned binary directly — full-history secret scan, no
      # license gate, fails the job on any finding.
      - name: Install gitleaks
        run: |
          set -euo pipefail
          VERSION=8.21.2
          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \
            | tar -xz -C /usr/local/bin gitleaks
          gitleaks version
      - name: Scan repository history
        run: gitleaks detect --source . --redact --verbose --exit-code 1

  fuzz:
    name: badgeverify fuzz
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: '1.25'
          cache: true
      # Bounded fuzz window over every badgeverify target. Seed corpora are
      # deterministic; this re-runs the seeds and explores new inputs for a
      # short, CI-friendly slice per target.
      - name: Fuzz parsers and verifiers
        run: |
          set -euo pipefail
          targets="FuzzParseBadge FuzzParseEnrollment FuzzParseRecovery FuzzVerify FuzzVerifyEnrollment FuzzVerifyRecovery"
          for t in $targets; do
            echo "::group::$t"
            go test -run='^$' -fuzz="^${t}$" -fuzztime=30s ./badgeverify/
            echo "::endgroup::"
          done