ci-hardened.yml

# HARDENED — vulnerable-nodejs CI (GitHub Actions)
# Reference version for the training lab docs/labs/11-poisoned-pipelines.md.
# Differences vs ci.yml:
#   1. No pull_request_target: fork PRs run with pull_request (no secrets),
#      secrets-consuming jobs trigger on push to trusted branches only
#   2. No untrusted interpolation into run: — payload data read from files
#      and passed as env, always quoted
#   3. Actions pinned to full commit SHAs
# The hardened pipeline IS the CI that runs on push/PR. The unsafe twin
# (ci.yml) is manual-only reading material for the poisoned-pipeline lab.
name: ci (hardened)

on:
  pull_request:             # untrusted PRs get sandboxed builds, no secrets
    branches: [master]
  push:
    branches: [master]
  workflow_dispatch:

# Least privilege: the workflow token can read the repo, nothing else.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2, SHA-pinned

      - name: Set up Node
        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0, SHA-pinned
        with:
          node-version: 22

      - name: Install
        run: npm install

      - name: Unit tests
        run: node --test sast/tests/ || true

      # Safe pattern: untrusted values go through env, quoted — never into
      # the script text itself. A PR title with shell metacharacters stays data.
      - name: Show PR metadata
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
        run: |
          echo "New PR: $PR_TITLE by $PR_AUTHOR"

  # Deployment smoke: build the hardened stack, wait for the app, assert
  # non-root. Proves the container hardening didn't break the boot.
  smoke:
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: read
    steps:
      - name: Check out
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2, SHA-pinned

      - name: Build and start stack
        run: docker compose up -d --build

      - name: Wait for app (http 200 on /login, max 60s)
        run: |
          code=""
          for i in $(seq 1 60); do
            code=$(curl -s -o /dev/null -w '%{http_code}' http://localhost:8888/login || true)
            [ "$code" = "200" ] && exit 0
            sleep 1
          done
          echo "app did not come up (last code: $code)"; docker compose logs web; exit 1

      - name: Assert web runs as non-root
        run: |
          user=$(docker compose exec -T web whoami)
          echo "whoami: $user"
          [ "$user" = "node" ] || { echo "expected 'node', got '$user'"; exit 1; }

      - name: Tear down
        run: docker compose down -v

  # Any job that consumes secrets runs ONLY on push from trusted branches.
  deploy:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    needs: test
    permissions:
      contents: read
    steps:
      - name: Check out
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Deploy (trusted code only)
        env:
          DEPLOY_API_KEY: ${{ secrets.DEPLOY_API_KEY }}
        run: |
          echo "Deploying with key ${DEPLOY_API_KEY:0:4}****"   # mask in logs
          # ./scripts/deploy.sh  — secrets reach the script via env, not argv

      - name: Build image tag from ref (safe)
        env:
          BRANCH: ${{ github.ref_name }}
        run: |
          echo "docker build -t vulnerable-nodejs:\${BRANCH//\//-} ."