learningcircuit--local-deep-research/.github/workflows/retirejs.yml

name: Retire.js Security Scan

on:
  workflow_dispatch:
  workflow_call:  # Called by release-gate.yml
  schedule:
    # Run weekly security scan on Mondays at 4 AM UTC
    - cron: '0 4 * * 1'

permissions: {}  # Minimal top-level for OSSF Scorecard Token-Permissions

# Note: No concurrency block - this workflow is called by release-gate.yml
# and concurrency settings can cause unexpected cancellations for reusable workflows

jobs:
  retirejs:
    name: Retire.js Vulnerability Scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

        with:
          persist-credentials: false

      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24'

      - name: Run Retire.js scan
        id: retire-scan
        run: |
          echo "=== Running Retire.js scan ==="
          # Use npx with specific version for reproducible builds
          # Scan JavaScript files and node_modules for known vulnerabilities
          # Only flag medium severity and above (exit code 13 when issues found)
          # Output both SARIF (for GitHub Security) and human-readable format
          npx retire@5.2.4 --js --node --severity medium --outputformat sarif --outputpath retire-results.sarif 2>&1 | tee retire-output.txt
          RETIRE_EXIT_CODE=$?

          # Check if vulnerabilities were found (exit code 13 indicates issues)
          if [ $RETIRE_EXIT_CODE -eq 13 ]; then
            echo "RETIRE_FOUND_ISSUES=true" >> "$GITHUB_ENV"
          fi

          # Display human-readable summary
          echo ""
          echo "=== Scan Summary ==="
          cat retire-output.txt

          # Check if SARIF file was created (for use in upload step)
          if [ -f "retire-results.sarif" ]; then
            echo "sarif_exists=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
        if: always() && steps.retire-scan.outputs.sarif_exists == 'true'
        with:
          sarif_file: retire-results.sarif
          category: retirejs

      - name: Check scan results
        run: |
          if [[ "$RETIRE_FOUND_ISSUES" == "true" ]]; then
            echo "::error::Retire.js found medium or higher severity vulnerabilities"
            echo "Review the Security tab for details"
            echo "Consider updating or replacing affected libraries"
            # Only fail for PR/push events, not scheduled scans
            if [[ "${{ github.event_name }}" != "schedule" ]]; then
              exit 1
            fi
            echo "::warning::Scheduled scan - reporting only, not failing the workflow"
          else
            echo "✅ No medium or higher severity vulnerabilities detected"
          fi