component-security-validation.yml

name: Component Security Validation

on:
  pull_request:
    paths:
      - 'cli-tool/components/**/*.md'
      - 'cli-tool/src/validation/**'
      - '.github/workflows/component-security-validation.yml'
  push:
    branches:
      - main
    paths:
      - 'cli-tool/components/**/*.md'

permissions:
  contents: read
  pull-requests: write

jobs:
  security-audit:
    name: Security Audit
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6
        with:
          fetch-depth: 0  # Full history for git metadata

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          node-version: '18'
          cache: 'npm'
          cache-dependency-path: cli-tool/package-lock.json

      - name: Install dependencies
        run: |
          cd cli-tool
          npm ci --ignore-scripts

      - name: Run Security Audit
        id: audit
        run: |
          cd cli-tool
          npm run security-audit:ci
        continue-on-error: true

      - name: Generate JSON Report
        if: always()
        run: |
          cd cli-tool
          npm run security-audit:json

      - name: Upload Security Report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: security-audit-report
          path: cli-tool/security-report.json
          retention-days: 30

      - name: Comment PR with Results
        if: github.event_name == 'pull_request' && always()
        uses: actions/github-script@v9
        with:
          script: |
            const fs = require('fs');
            const reportPath = 'cli-tool/security-report.json';

            if (!fs.existsSync(reportPath)) {
              console.log('No security report found');
              return;
            }

            const report = JSON.parse(fs.readFileSync(reportPath, 'utf8'));

            const passed = report.summary.passed;
            const failed = report.summary.failed;
            const warnings = report.summary.warnings;
            const total = report.summary.total;

            const status = failed === 0 ? '✅ PASSED' : '❌ FAILED';
            const emoji = failed === 0 ? '🎉' : '⚠️';

            let comment = `## ${emoji} Security Audit Report\n\n`;
            comment += `**Status**: ${status}\n\n`;

            // Summary table
            comment += `| Metric | Count |\n`;
            comment += `|--------|-------|\n`;
            comment += `| Total Components | ${total} |\n`;
            comment += `| ✅ Passed | ${passed} |\n`;
            comment += `| ❌ Failed | ${failed} |\n`;
            comment += `| ⚠️ Warnings | ${warnings} |\n\n`;

            if (failed > 0) {
              comment += `### ❌ Failed Components (Top 5)\n\n`;
              comment += `| Component | Errors | Warnings | Score |\n`;
              comment += `|-----------|--------|----------|-------|\n`;

              const failedComponents = report.components
                .filter(c => !c.overall.valid)
                .sort((a, b) => b.overall.errorCount - a.overall.errorCount)
                .slice(0, 5);

              for (const component of failedComponents) {
                const name = component.component.path.split('/').pop().replace('.md', '');
                comment += `| \`${name}\` | ${component.overall.errorCount} | ${component.overall.warningCount} | ${component.overall.score}/100 |\n`;
              }

              if (report.components.filter(c => !c.overall.valid).length > 5) {
                const remaining = report.components.filter(c => !c.overall.valid).length - 5;
                comment += `\n*...and ${remaining} more failed component(s)*\n`;
              }
            }

            comment += `\n---\n`;
            comment += `📊 **[View Full Report](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})** for detailed error messages and all components`;

            // Post comment
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });