security-pipeline.yml

name: ComplianceForge Security Pipeline

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pip-audit semgrep checkov

      # ----------------------------
      # Dependency Security Scan
      # ----------------------------
      - name: Run pip-audit (Dependency Scan)
        run: pip-audit || true

      # ----------------------------
      # Static Analysis (SAST)
      # ----------------------------
      - name: Run Semgrep SAST Scan
        run: semgrep --config=auto . || true

      # ----------------------------
      # Infrastructure Security Scan
      # ----------------------------
      - name: Run Checkov (IaC Scan)
        run: checkov -d . || true

      # ----------------------------
      # Security Summary
      # ----------------------------
      - name: Security Scan Complete
        run: echo "Security pipeline execution completed"