security.yml

# SPDX-License-Identifier: Apache-2.0

name: Security
on:
  pull_request:
    branches:
      - "main"
      - "release/**"
  push:
    branches:
      - "main"
      - "release/**"
    tags:
      - "v*"

defaults:
  run:
    shell: bash

permissions:
  contents: read

env:
  LC_ALL: C.UTF-8

jobs:
  dependencies:
    name: Dependency Check
    runs-on: hiero-mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 21

      - name: Install JDK
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4
        with:
          gradle-home-cache-includes: |
            caches
            notifications
            jdks
            dependency-check-data
          # write a cache on all executions to ensure the NVD data stays up-to-date
          cache-read-only: false

      - name: Vulnerability check
        run: ./gradlew dependencyCheckAggregate
        timeout-minutes: 20

      - name: Upload report
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
        if: failure()
        with:
          name: dependency-check-report
          path: build/reports/dependency-check-report.html

  gosec:
    name: GoSec Code Scan
    env:
      GO111MODULE: on
    runs-on: hiero-mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: tmp

      - name: Copy hedera-mirror-rosetta to workspace root
        working-directory: .
        run: |
          cp -r tmp/hedera-mirror-rosetta/* .
          rm -fr tmp

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 21

      - name: Setup GoLang
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version: 1.23

      - name: Run Gosec Security Scanner
        uses: securego/gosec@136f6c00402b11775d4f4a45d5a21e2f6dd99db2 # v2.22.2
        with:
          args: ./...

  snyk:
    if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
    name: Snyk Open Source
    runs-on: hiero-mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 21

      - name: Install JDK
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4

      - name: Setup Snyk
        run: npm install -g snyk-to-html @wcj/html-to-markdown-cli

      - name: Execute Snyk Test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: ./gradlew snyk-test

      - name: Publish Snyk Results
        continue-on-error: true
        if: ${{ !cancelled() && always() }}
        run: |
          report="build/reports/snyk-test"
          if [[ -f ${report}.json ]]; then
            snyk-to-html -i ${report}.json -o ${report}.html && \
            html-to-markdown ${report}.html -o build/reports && \
            cat ${report}.html.md >> $GITHUB_STEP_SUMMARY
          fi

  snyk-code:
    if: github.event_name == 'push' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
    name: Snyk Code
    runs-on: hiero-mirror-node-linux-large
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Setup Node
        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
        with:
          node-version: 21

      - name: Install JDK
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4

      - name: Setup Snyk
        run: npm install -g snyk-to-html @wcj/html-to-markdown-cli

      - name: Execute Snyk Code Test
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        run: ./gradlew snyk-code

      - name: Publish Snyk Results
        continue-on-error: true
        if: ${{ !cancelled() && always() }}
        run: |
          report="build/reports/snyk-code"
          if [[ -f ${report}.json ]]; then
            snyk-to-html -i ${report}.json -o ${report}.html && \
            html-to-markdown ${report}.html -o build/reports && \
            cat ${report}.html.md >> $GITHUB_STEP_SUMMARY
          fi

  spotless-check:
    name: Spotless Code Format Check
    runs-on: hiero-mirror-node-linux-medium
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
        with:
          egress-policy: audit

      - name: Checkout Code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 1

      - name: Install JDK
        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
        with:
          distribution: temurin
          java-version: 21

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@94baf225fe0a508e581a564467443d0e2379123b # v4

      - name: Execute Gradle
        run: ./gradlew spotlessCheck

      - name: Fail on Unformatted Files
        if: failure()
        run: echo "Spotless check failed. Code formatting issues found. Please run './gradlew spotlessApply' locally and commit the changes."