Dependency Security

name: Security Checks

on:
  push:
    branches: [main]
  schedule:
    # Weekly full scan every Monday at 08:00 UTC
    - cron: '0 8 * * 1'
  workflow_dispatch:

# .github/workflows/security.yml
- name: Run npm audit
  # --audit-level=critical: next@14 and eslint-config-next glob are flagged
  # HIGH for server-side features (RSC deserialization, Image Optimizer).
  # This project uses output:'export' with images.unoptimized=true — those
  # attack surfaces do not exist. Only CRITICAL findings block the build.
  run: npm audit --audit-level=critical

// next.config.js - Static export configuration
const nextConfig = {
  output: 'export',  // Disables server-side features entirely
  images: {
    unoptimized: true  // Disables Image Optimization API
  }
}

# Run critical-only audit (matches CI)
npm audit --audit-level=critical

# View all advisories including HIGH
npm audit

# Generate detailed audit report
npm audit --json > audit-report.json

# Fix all automatically patchable vulnerabilities
npm audit fix

# .github/workflows/security.yml
codeql:
  name: CodeQL Static Analysis
  runs-on: ubuntu-latest
  permissions:
    actions: read
    contents: read
    security-events: write
  steps:
    - name: Initialize CodeQL
      uses: github/codeql-action/init@v4
      with:
        languages: javascript-typescript
        queries: security-extended

    - name: Autobuild
      uses: github/codeql-action/autobuild@v4

    - name: Perform CodeQL Analysis
      uses: github/codeql-action/analyze@v4
      with:
        category: '/language:javascript-typescript'

// ❌ Unsafe: Direct innerHTML assignment
element.innerHTML = userInput

// ✅ Safe: React JSX escaping
return <div>{userInput}</div>

// ❌ Unsafe: eval with user input
eval(code)

// ✅ Safe: Function constructor (still avoid, but safer)
new Function(code)()

// ❌ Unsafe: RegExp denial of service
const regex = new RegExp('(a+)+$')
regex.test(longString)  // Can hang for exponential time

// ✅ Safe: Non-backtracking regex
const regex = /^[a-z0-9]+$/

# .github/workflows/security.yml
secret-scan:
  name: Secret Scanning
  runs-on: ubuntu-latest
  steps:
    - name: TruffleHog secret scan (verified)
      uses: trufflesecurity/trufflehog@648aca62d5437454d477426fb20c29f402c06a4e
      with:
        path: ./
        base: ${{ github.event.before || github.sha }}
        head: ${{ github.sha }}
        extra_args: --only-verified

    - name: TruffleHog secret scan (unverified high-confidence)
      uses: trufflesecurity/trufflehog@648aca62d5437454d477426fb20c29f402c06a4e
      continue-on-error: true
      with:
        path: ./
        base: ${{ github.event.before || github.sha }}
        head: ${{ github.sha }}

// ❌ False positive: Test JWT
const mockToken = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...'

// ✅ Excluded: Add to .trufflehogignore or use placeholder
const mockToken = 'eyJhbGc_REDACTED_'

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    rebase-strategy: "disabled"
    open-pull-requests-limit: 3
    labels:
      - "dependencies"
    ignore:
      # Review major version bumps manually
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]
    # Group all minor/patch updates into a single weekly PR
    groups:
      npm-minor-patch:
        patterns:
          - "*"
        update-types:
          - "minor"
          - "patch"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
      day: "monday"
    rebase-strategy: "disabled"
    open-pull-requests-limit: 1
    labels:
      - "dependencies"
      - "ci"
    groups:
      github-actions:
        patterns:
          - "*"

# Mark advisory as dismissed in GitHub UI
# Security → Dependabot alerts → Dismiss → Reason: "Not applicable to static export"

ignore:
  - dependency-name: "next"
    update-types: ["version-update:semver-minor"]
    # Reason: Waiting for feature X in next major version

# .github/workflows/sbom.yml
name: Generate SBOM

on:
  push:
    branches: [main]
  release:
    types: [published]
  workflow_dispatch:

jobs:
  sbom:
    name: Generate CycloneDX SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - uses: actions/setup-node@v6
        with:
          node-version: '20'
          cache: 'npm'

      - name: Install dependencies
        run: npm ci

      - name: Generate SBOM (JSON)
        run: npx --yes @cyclonedx/cyclonedx-npm --output-format JSON --output-file sbom.json

      - name: Upload SBOM artifact
        uses: actions/upload-artifact@v7
        with:
          name: sbom-${{ github.sha }}
          path: sbom.json
          retention-days: 90

      - name: Attach SBOM to release
        if: github.event_name == 'release'
        uses: softprops/action-gh-release@v2
        with:
          files: sbom.json

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": {
    "component": {
      "type": "application",
      "name": "kaystons-forge",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "next",
      "version": "14.2.3",
      "purl": "pkg:npm/[email protected]",
      "licenses": [{"license": {"id": "MIT"}}],
      "hashes": [{"alg": "SHA-512", "content": "..."}]
    },
    // ... all 200+ dependencies
  ],
  "dependencies": [
    {"ref": "pkg:npm/[email protected]", "dependsOn": ["pkg:npm/[email protected]"]}
  ]
}

# Using OWASP Dependency-Track
curl -X POST 'https://dependency-track.example.com/api/v1/bom' \
  -H 'X-API-Key: YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d @sbom.json

# Using Grype (open-source)
grype sbom:./sbom.json

# ✅ Ensures reproducible builds
git add package-lock.json

# ❌ Never delete lockfile to "fix" install issues
git rm package-lock.json  # DON'T DO THIS

# ✅ Pinned to specific commit
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v6.0.0

# ❌ Vulnerable to tag tampering
- uses: actions/checkout@v6

# View full dependency tree
npm ls

# Find which package depends on a vulnerable package
npm ls <vulnerable-package>

# Force update transitive dependency
npm update <parent-package>

# SLSA Level 3 provenance
npx @sigstore/cosign sign-blob sbom.json

npx license-checker --production --excludePrivatePackages

- uses: actions/dependency-review-action@v4
  with:
    fail-on-severity: moderate