learningcircuit--local-deep-research/.github/workflows/danger-zone-alert.yml

name: 🚨 Danger Zone Alert

on:
  pull_request:
    types: [opened, synchronize]
    paths:
      # Explicit paths only — no keyword globs. A filename containing
      # "decrypt" or "password" is not enough to imply security impact.
      #
      # ⚠️ KEEP IN SYNC with two other lists below:
      #   1. EXPLICIT_WATCHED array in the "Validate watchlist" step
      #      (drops glob entries; literal paths only — used for drift detection).
      #   2. `case` patterns in the "Classify critical changes" step
      #      (routes each path to a label bucket).
      # A path here that's missing from (2) silently fails to label;
      # a path in (2) that's missing here never triggers the workflow.
      #
      # Encryption / at-rest crypto / credential storage
      - 'src/local_deep_research/database/encrypted_db.py'
      - 'src/local_deep_research/database/sqlcipher_*.py'
      - 'src/local_deep_research/database/credential_store_base.py'
      - 'src/local_deep_research/database/backup/**'
      # Authentication / sessions / passwords / auth DB / tenant isolation
      - 'src/local_deep_research/web/auth/**'
      - 'src/local_deep_research/database/auth_db.py'
      - 'src/local_deep_research/database/session_passwords.py'
      - 'src/local_deep_research/database/temp_auth.py'
      - 'src/local_deep_research/database/session_context.py'
      # Web hardening — CSP, SSRF, CSRF, rate-limit, headers, validators
      - 'src/local_deep_research/security/**'
      - 'src/local_deep_research/settings/env_definitions/security.py'

# No concurrency group — intentionally omitted.
# Previous attempt (#3554, reverted #3599) used cancel-in-progress which
# killed in-progress PR runs before they produced useful results.
# Future iteration could safely add concurrency for scheduled/push-only
# triggers (where head_ref is empty and runs get unique groups).

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

jobs:
  danger-alert:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write
      issues: write  # needed for createLabel (auto-create on first run)

    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
      with:
        egress-policy: audit

    - name: Checkout code
      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      with:
        persist-credentials: false
        fetch-depth: 0

    - name: Validate watchlist against repo tree
      # Drift-guard: every explicit (non-glob) path below must exist on the
      # branch head. Fails the workflow if a watched file has been renamed
      # or deleted without updating this list. Glob patterns are excluded
      # — they self-heal on rename and would false-positive this check.
      # (Tradeoff: if all files matching a glob like `sqlcipher_*.py` are
      # deleted, the trigger path silently becomes a no-op. Acceptable —
      # disappearing an entire subsystem will be caught in code review.)
      #
      # ⚠️ KEEP IN SYNC with `on.pull_request.paths` above and the `case`
      # patterns in the "Classify critical changes" step below.
      run: |
        EXPLICIT_WATCHED=(
          "src/local_deep_research/database/encrypted_db.py"
          "src/local_deep_research/database/credential_store_base.py"
          "src/local_deep_research/database/auth_db.py"
          "src/local_deep_research/database/session_passwords.py"
          "src/local_deep_research/database/temp_auth.py"
          "src/local_deep_research/database/session_context.py"
          "src/local_deep_research/settings/env_definitions/security.py"
        )
        missing=0
        for p in "${EXPLICIT_WATCHED[@]}"; do
          if [ ! -e "$p" ]; then
            echo "::error::danger-zone-alert watchlist drift: $p does not exist"
            missing=1
          fi
        done
        [ $missing -eq 0 ]

    - name: Classify critical changes
      id: analyze
      env:
        BASE_REF: ${{ github.base_ref }}
      run: |
        # Use env var to prevent template injection from malicious branch names
        CHANGED=$(git diff --name-only "origin/$BASE_REF...HEAD")

        ENCRYPTION_MODIFIED=false
        AUTH_MODIFIED=false
        HARDENING_MODIFIED=false

        # Shell `case` `*` matches `/` (unlike file globs), so `web/auth/*`
        # and `backup/*` cover nested subdirs — equivalent to the `**` in
        # GitHub Actions path globs above. Do NOT "fix" these to `**` —
        # bash `case` treats `**` as two literal `*`s with no special
        # meaning and it would stop matching anything with a slash.
        #
        # ⚠️ KEEP IN SYNC with `on.pull_request.paths` above and the
        # EXPLICIT_WATCHED array in the "Validate watchlist" step above.
        for file in $CHANGED; do
          case "$file" in
            src/local_deep_research/database/encrypted_db.py|\
            src/local_deep_research/database/sqlcipher_*.py|\
            src/local_deep_research/database/credential_store_base.py|\
            src/local_deep_research/database/backup/*)
              ENCRYPTION_MODIFIED=true ;;
            src/local_deep_research/web/auth/*|\
            src/local_deep_research/database/auth_db.py|\
            src/local_deep_research/database/session_passwords.py|\
            src/local_deep_research/database/temp_auth.py|\
            src/local_deep_research/database/session_context.py)
              AUTH_MODIFIED=true ;;
            src/local_deep_research/security/*|\
            src/local_deep_research/settings/env_definitions/security.py)
              HARDENING_MODIFIED=true ;;
          esac
        done

        HAS_CRITICAL=false
        if [ "$ENCRYPTION_MODIFIED" = "true" ] || [ "$AUTH_MODIFIED" = "true" ] || [ "$HARDENING_MODIFIED" = "true" ]; then
          HAS_CRITICAL=true
        fi

        {
          echo "has_critical=$HAS_CRITICAL"
          echo "encryption_modified=$ENCRYPTION_MODIFIED"
          echo "auth_modified=$AUTH_MODIFIED"
          echo "hardening_modified=$HARDENING_MODIFIED"
        } >> "$GITHUB_OUTPUT"

    - name: Create status check
      if: steps.analyze.outputs.has_critical == 'true'
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      with:
        script: |
          // Neutral check — advisory, not blocking. Real enforcement, if
          // desired, belongs in branch-protection rules, not in a status
          // title that misleads reviewers.
          try {
            await github.rest.checks.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              name: 'Security Review Required',
              head_sha: context.sha,
              status: 'completed',
              conclusion: 'neutral',
              output: {
                title: 'Security-sensitive paths modified',
                summary: 'This PR modifies critical security code (encryption, authentication, or web hardening). Please review carefully.'
              }
            });
          } catch (err) {
            // Fork PRs get a read-only token — checks.create 403s. Log
            // and stay green (same pattern as pr-triage.yml); reviewers
            // still get the signal from CODEOWNERS on these paths.
            if (err.status !== 403) throw err;
            console.log('checks.create returned 403 (read-only fork token). Skipping.');
          }

    - name: Add labels
      if: steps.analyze.outputs.has_critical == 'true'
      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
      env:
        ENCRYPTION_MODIFIED: ${{ steps.analyze.outputs.encryption_modified }}
        AUTH_MODIFIED: ${{ steps.analyze.outputs.auth_modified }}
        HARDENING_MODIFIED: ${{ steps.analyze.outputs.hardening_modified }}
      with:
        script: |
          const wanted = [];
          if (process.env.ENCRYPTION_MODIFIED === 'true') {
            wanted.push({ name: 'touches-encryption', color: 'b60205', description: 'Modifies at-rest crypto, credential storage, or backup encryption' });
          }
          if (process.env.AUTH_MODIFIED === 'true') {
            wanted.push({ name: 'touches-authentication', color: 'd93f0b', description: 'Modifies login, sessions, passwords, auth DB, or tenant isolation' });
          }
          if (process.env.HARDENING_MODIFIED === 'true') {
            wanted.push({ name: 'touches-web-hardening', color: 'fbca04', description: 'Modifies CSP, SSRF, CSRF, rate-limit, headers, validators, or hardening config' });
          }

          if (wanted.length === 0) return;

          // Ensure each label exists before applying (addLabels 422s on unknown labels).
          for (const l of wanted) {
            try {
              await github.rest.issues.createLabel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                name: l.name,
                color: l.color,
                description: l.description,
              });
            } catch (e) {
              // 422 = already exists. 403 = read-only fork token (the
              // addLabels call below degrades the same way).
              if (e.status !== 422 && e.status !== 403) throw e;
            }
          }

          try {
            await github.rest.issues.addLabels({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              labels: wanted.map(l => l.name),
            });
          } catch (err) {
            // Fork PRs get a read-only token — the call 403s. Log and
            // stay green (same pattern as pr-triage.yml); a maintainer
            // can apply the labels manually on fork PRs.
            if (err.status !== 403) throw err;
            console.log('Label call returned 403 (read-only fork token). Skipping.');
          }