name: Security Scanning

# ============================================================================
# WICHTIG: Dieser Workflow wurde optimiert um ohne kostenpflichtige GitHub
# Features (CodeQL, GHAS) auszukommen. Für private Repos sind diese Features
# kostenpflichtig (~$49/Monat pro Seat).
#
# Stattdessen verwenden wir:
# - pnpm audit für Dependency Scanning
# - ESLint mit Security-Plugin für Code-Analyse
# - Lokale Security Tests
# ============================================================================

on:
  # Nur bei PRs auf main und wöchentlich - spart GitHub Actions Minuten
  pull_request:
    branches: [main]
  schedule:
    # Wöchentlich Sonntag um 00:00 UTC
    - cron: '0 0 * * 0'
  # Manuelle Auslösung für on-demand Scans
  workflow_dispatch:

permissions:
  contents: read

env:
  NODE_VERSION: '20'
  PNPM_VERSION: '9'

jobs:
  # ===========================================================================
  # Dependency Vulnerability Scanning (kostenlos)
  # ===========================================================================
  dependencies:
    name: Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run pnpm audit
        run: pnpm audit --audit-level=high
        continue-on-error: true

      - name: Create audit summary
        run: |
          echo "## Dependency Audit Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          pnpm audit --json 2>/dev/null | jq -r '
            if .advisories then
              .advisories | to_entries[] |
              "| \(.value.severity | ascii_upcase) | \(.value.module_name) | \(.value.title) |"
            else
              "No vulnerabilities found"
            end
          ' >> $GITHUB_STEP_SUMMARY 2>/dev/null || echo "✅ No vulnerabilities found" >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # ESLint Security Analysis (kostenlos, ersetzt CodeQL)
  # ===========================================================================
  eslint-security:
    name: ESLint Security
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run ESLint
        run: pnpm lint
        continue-on-error: true

      - name: Security summary
        run: |
          echo "## ESLint Security Check" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "ESLint wurde ausgeführt um potenzielle Sicherheitsprobleme zu finden." >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Hinweis:** Für erweiterte Sicherheitsanalyse (wie CodeQL) wird GitHub Advanced Security benötigt." >> $GITHUB_STEP_SUMMARY

  # ===========================================================================
  # Security Unit & Integration Tests
  # ===========================================================================
  security-tests:
    name: Security Tests
    runs-on: ubuntu-latest
    needs: [dependencies]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup pnpm
        uses: pnpm/action-setup@v3
        with:
          version: ${{ env.PNPM_VERSION }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Run security tests
        run: pnpm test:security
        env:
          CSRF_SECRET: test-csrf-secret
          PAYLOAD_SECRET: test-payload-secret
          PAYLOAD_PUBLIC_SERVER_URL: https://test.example.com
          NEXT_PUBLIC_SERVER_URL: https://test.example.com

      - name: Upload test results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-test-results
          path: |
            coverage/
            test-results/
          retention-days: 7

  # ===========================================================================
  # Security Summary
  # ===========================================================================
  summary:
    name: Security Summary
    runs-on: ubuntu-latest
    needs: [dependencies, eslint-security, security-tests]
    if: always()
    steps:
      - name: Create summary
        run: |
          echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Check | Status |" >> $GITHUB_STEP_SUMMARY
          echo "|-------|--------|" >> $GITHUB_STEP_SUMMARY
          echo "| Dependency Audit | ${{ needs.dependencies.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| ESLint Security | ${{ needs.eslint-security.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Security Tests | ${{ needs.security-tests.result }} |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "---" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Info:** GitHub Secret Scanning ist in den Repository-Einstellungen aktiviert (kostenlos für alle Repos)." >> $GITHUB_STEP_SUMMARY