1# GitHub Actions — all core security gates on every PR
2# Blocks merge on critical findings; reports medium/low as warnings
3name: Secure CI Pipeline
4 
5on:
6  pull_request:
7    branches: [main, develop]
8  push:
9    branches: [main]
10 
11jobs:
12  # Gate 1: Secret scanning — block any secrets committed
13  secret-scan:
14    name: Secret Scanning
15    runs-on: ubuntu-latest
16    steps:
17      - uses: actions/checkout@v4
18        with:
19          fetch-depth: 0  # Full history for git-log-based scanning
20      - name: Run Gitleaks
21        uses: gitleaks/gitleaks-action@v2
22        env:
23          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24        # Fails the job if any secrets are found
25 
26  # Gate 2: SAST — static analysis on every commit
27  sast:
28    name: Static Analysis (SAST)
29    runs-on: ubuntu-latest
30    steps:
31      - uses: actions/checkout@v4
32      - name: Run Semgrep
33        uses: semgrep/semgrep-action@v1
34        with:
35          config: >-
36            p/owasp-top-ten
37            p/secrets
38            p/python
39            p/javascript
40        env:
41          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
42        # Blocks on critical/high; reports medium/low as warnings
43 
44  # Gate 3: Dependency scanning
45  dependency-scan:
46    name: Dependency Vulnerability Scan
47    runs-on: ubuntu-latest
48    steps:
49      - uses: actions/checkout@v4
50      - name: Run Snyk
51        uses: snyk/actions/node@master
52        with:
53          args: --severity-threshold=high
54        env:
55          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
56        # --severity-threshold=high: only fail on high/critical CVEs
57 
58  # Gate 4: Container image scanning (runs after build)
59  container-scan:
60    name: Container Image Scan
61    runs-on: ubuntu-latest
62    needs: [secret-scan, sast]
63    steps:
64      - uses: actions/checkout@v4
65      - name: Build image
66        run: docker build -t myapp:pr-${{ github.run_number }} .
67      - name: Scan with Trivy
68        uses: aquasecurity/trivy-action@master
69        with:
70          image-ref: myapp:pr-${{ github.run_number }}
71          format: sarif
72          output: trivy-results.sarif
73          severity: CRITICAL,HIGH
74          exit-code: 1  # Fail on critical/high
75      - name: Upload Trivy results to Security tab
76        uses: github/codeql-action/upload-sarif@v3
77        with:
78          sarif_file: trivy-results.sarif

1# OPA policy — run with Conftest before terraform apply
2# Blocks any plan that would create a public S3 bucket
3package terraform.aws.s3
4 
5import future.keywords.if
6import future.keywords.contains
7 
8# Deny any S3 bucket that does not have public access block configured
9deny contains msg if {
10    resource := input.resource_changes[_]
11    resource.type == "aws_s3_bucket"
12    resource.change.actions[_] == "create"
13    not has_public_access_block(resource.address)
14    msg := sprintf(
15        "S3 bucket '%v' must have aws_s3_bucket_public_access_block configured",
16        [resource.address]
17    )
18}
19 
20# Also deny if public access block is configured but allows public access
21deny contains msg if {
22    resource := input.resource_changes[_]
23    resource.type == "aws_s3_bucket_public_access_block"
24    resource.change.after.block_public_acls == false
25    msg := sprintf(
26        "S3 bucket public access block '%v' must set block_public_acls = true",
27        [resource.address]
28    )
29}
30 
31has_public_access_block(bucket_address) if {
32    resource := input.resource_changes[_]
33    resource.type == "aws_s3_bucket_public_access_block"
34    resource.change.after.bucket == bucket_address
35}