name: API Security Scan

on:
    push:
        branches: [main]
        paths:
            - "backend/**"
    pull_request:
        branches: [main]
        paths:
            - "backend/**"
    schedule:
        - cron: "0 6 * * 1" # Lundi 6h00 UTC
    workflow_dispatch:

permissions:
    contents: read
    security-events: write

jobs:
    govulncheck:
        name: Go Vulnerability Check (CVE)
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Setup Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24.4"
                  cache-dependency-path: backend/gestion/go.sum

            - name: Install govulncheck
              run: go install golang.org/x/vuln/cmd/govulncheck@latest

            - name: Run govulncheck
              working-directory: backend/gestion
              run: govulncheck ./...

    trivy:
        name: Trivy - Dependency & Code Scan
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Trivy scan (filesystem)
              uses: aquasecurity/trivy-action@0.28.0
              with:
                  scan-type: fs
                  scan-ref: backend/gestion
                  format: sarif
                  output: trivy-results.sarif
                  severity: CRITICAL,HIGH,MEDIUM
                  exit-code: "1"

            - name: Upload Trivy SARIF
              if: always()
              uses: github/codeql-action/upload-sarif@v3
              with:
                  sarif_file: trivy-results.sarif

    gosec:
        name: Gosec - Security Hotspots
        runs-on: ubuntu-latest

        steps:
            - uses: actions/checkout@v4

            - name: Setup Go
              uses: actions/setup-go@v5
              with:
                  go-version: "1.24.4"
                  cache-dependency-path: backend/gestion/go.sum

            - name: Run gosec
              uses: securego/gosec@master
              with:
                  args: -fmt sarif -out gosec-results.sarif -exclude-dir=vendor ./...
                  working-directory: backend/gestion

            - name: Upload gosec SARIF
              if: always()
              uses: github/codeql-action/upload-sarif@v3
              with:
                  sarif_file: backend/gestion/gosec-results.sarif