feat: add Phase 9 — Security Scanning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 15:30:38 -06:00
parent 9379b95a41
commit ea5524949a
3 changed files with 264 additions and 0 deletions
--- a/phase9_security.sh
+++ b/phase9_security.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase9_security.sh — Deploy security scanning workflows to all repos
+# Depends on: Phase 5 complete (repos have .gitea/workflows/)
+# For each repo:
+#   1. Clone from Gitea to temp directory
+#   2. Render security-scan.yml.tpl → .gitea/workflows/security-scan.yml
+#   3. Commit and push
+#   4. If SECURITY_FAIL_ON_ERROR=true, update branch protection to require
+#      security status checks (semgrep, trivy, gitleaks)
+# The security workflow runs Semgrep (SAST), Trivy (container/dependency scan),
+# and Gitleaks (secret detection) on every pull request.
+# Idempotent: skips repos that already have security-scan.yml.
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+
+load_env
+require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
+             GITEA_ADMIN_USER \
+             REPO_1_NAME REPO_2_NAME REPO_3_NAME \
+             SEMGREP_VERSION TRIVY_VERSION GITLEAKS_VERSION \
+             SECURITY_FAIL_ON_ERROR PROTECTED_BRANCH
+
+phase_header 9 "Security Scanning"
+
+REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
+TEMP_BASE="/tmp/gitea-migration-security"
+
+cleanup() {
+  rm -rf "$TEMP_BASE"
+}
+trap cleanup EXIT
+
+SUCCESS=0
+SKIPPED=0
+FAILED=0
+
+for repo in "${REPOS[@]}"; do
+  log_info "--- Processing repo: ${repo} ---"
+
+  # -------------------------------------------------------------------------
+  # Idempotency: check if security-scan.yml already exists via API
+  # -------------------------------------------------------------------------
+  if gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/contents/.gitea/workflows/security-scan.yml" >/dev/null 2>&1; then
+    log_info "security-scan.yml already exists in ${repo} — skipping"
+    SKIPPED=$((SKIPPED + 1))
+    continue
+  fi
+
+  # -------------------------------------------------------------------------
+  # Step 1: Clone the repo
+  # -------------------------------------------------------------------------
+  CLONE_DIR="${TEMP_BASE}/${repo}"
+  rm -rf "$CLONE_DIR"
+  mkdir -p "$CLONE_DIR"
+
+  CLONE_URL=$(echo "${GITEA_INTERNAL_URL}" | sed "s|://|://${GITEA_ADMIN_USER}:${GITEA_ADMIN_TOKEN}@|")
+  log_info "Cloning ${repo}..."
+  git clone -q "${CLONE_URL}/${GITEA_ORG_NAME}/${repo}.git" "$CLONE_DIR"
+
+  # -------------------------------------------------------------------------
+  # Step 2: Render security workflow template
+  # The template references tool versions from .env so they're pinned
+  # and reproducible across all repos.
+  # -------------------------------------------------------------------------
+  log_info "Rendering security-scan.yml..."
+  mkdir -p "${CLONE_DIR}/.gitea/workflows"
+  export SEMGREP_VERSION TRIVY_VERSION GITLEAKS_VERSION PROTECTED_BRANCH
+  render_template "${SCRIPT_DIR}/templates/workflows/security-scan.yml.tpl" \
+    "${CLONE_DIR}/.gitea/workflows/security-scan.yml"
+
+  # -------------------------------------------------------------------------
+  # Step 3: Commit and push
+  # -------------------------------------------------------------------------
+  cd "$CLONE_DIR"
+  git config user.name "Gitea Migration"
+  git config user.email "migration@gitea.local"
+  git add .gitea/workflows/security-scan.yml
+  git commit -q -m "Add security scanning workflow (Semgrep + Trivy + Gitleaks)"
+  git push -q origin HEAD
+  cd "$SCRIPT_DIR"
+
+  log_success "Security workflow deployed to ${repo}"
+
+  # -------------------------------------------------------------------------
+  # Step 4: Update branch protection to require security status checks
+  # Only if SECURITY_FAIL_ON_ERROR=true — this means PRs cannot be merged
+  # unless all three security scans pass.
+  # -------------------------------------------------------------------------
+  if [[ "$SECURITY_FAIL_ON_ERROR" == "true" ]]; then
+    log_info "Updating branch protection to require security checks..."
+
+    # PATCH the existing branch protection to add status check contexts
+    PATCH_PAYLOAD=$(jq -n '{
+      enable_status_check: true,
+      status_check_contexts: ["semgrep", "trivy", "gitleaks"]
+    }')
+
+    if gitea_api PATCH "/repos/${GITEA_ORG_NAME}/${repo}/branch_protections/${PROTECTED_BRANCH}" "$PATCH_PAYLOAD" >/dev/null 2>&1; then
+      log_success "Branch protection updated with security status checks"
+    else
+      log_warn "Could not update branch protection — may need to be set manually"
+    fi
+  fi
+
+  SUCCESS=$((SUCCESS + 1))
+done
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+printf '\n'
+TOTAL=${#REPOS[@]}
+log_info "Results: ${SUCCESS} deployed, ${SKIPPED} skipped, ${FAILED} failed (out of ${TOTAL})"
+
+if [[ $FAILED -gt 0 ]]; then
+  log_error "Some repos failed — check logs above"
+  exit 1
+fi
+
+log_success "Phase 9 complete — security scanning deployed"