security.yml

name: Security Audit

on:
  push:
    # F3: also run on ci-staging, not just main. promote_staging.sh (the only path onto
    # branch-protected main) reads these jobs' check-runs for the ci-staging SHA BEFORE
    # promoting -- if this only ran on main, that data would not exist yet at decision
    # time (promotion IS what puts the SHA on main), so the required-check gate added to
    # promote_staging.sh would see "MISSING" forever and never promote anything.
    branches: [main, ci-staging]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 4 * * 1' # Weekly Monday 04:00 UTC

jobs:
  audit:
    name: Dependency Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: npm audit (production)
        run: npm audit --production --audit-level=high || true

      - name: Check for known vulnerabilities
        run: |
          echo "=== High/Critical vulnerabilities ==="
          VULNS=$(npm audit --production --json 2>/dev/null | node -e "
            const d=require('fs').readFileSync('/dev/stdin','utf8');
            try { const j=JSON.parse(d); console.log(j.metadata?.vulnerabilities?.high||0,j.metadata?.vulnerabilities?.critical||0); }
            catch { console.log('0 0'); }
          ")
          HIGH=$(echo $VULNS | cut -d' ' -f1)
          CRIT=$(echo $VULNS | cut -d' ' -f2)
          echo "High: $HIGH, Critical: $CRIT"
          if [ "$CRIT" -gt 0 ]; then
            echo "::error::Critical vulnerabilities found!"
            exit 1
          fi

  typecheck:
    name: Type Safety
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: Generate Prisma client
        run: npx prisma generate

      - name: TypeScript strict check
        run: npx tsc --noEmit --skipLibCheck

  adapter-boundary:
    name: Adapter Import Boundary
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: No adapter imported outside pipeline/tests
        run: python3 scripts/check-adapter-import-boundary.py

  mount-nginx-parity:
    name: Mount-Nginx Parity
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Every declared route has an nginx location proxying to it
        run: python3 scripts/check-mount-nginx-parity.py

  static-no-clipped-overflow:
    # T-60 (2026-09-02): the homepage's "vs alternatives" comparison table was
    # reported live, on an iPhone (Safari), as cut off with no way to scroll to
    # the missing content -- every static/*.html page wraps its content in
    # `.window`, which sets overflow:hidden, and a wide element (table/pre) with
    # no scroll wrapper of its own gets silently CLIPPED by that ancestor on a
    # narrow viewport instead of becoming scrollable. Static analysis (markup +
    # each page's own inline CSS), not a live browser resize -- see the script's
    # own header for why and for the structural invariant it actually enforces.
    # Fable ruling-1: also covers the sibling defect -- a wide element with NO
    # scroll wrapper AND no overflow:hidden ancestor above it either, which
    # drags the whole page into horizontal scroll instead of just clipping.
    # Requiring a scroll ancestor unconditionally catches both symptoms of the
    # same missing wrapper, so relaxing `.window` to overflow:visible can't
    # silently turn a clipped table into a page-scrolling one and stay green.
    # T-75 (2026-09-03): the T-60 fix above was patched into the committed static/catalog.html
    # but never into scripts/gen-catalog-page.ts, which REGENERATES that file wholesale on every
    # sync-counts.sh run (daily cron + onboarding). Every regen silently reverted the fix -- the
    # step above stayed green throughout, because it only ever reads whatever HAPPENS to be
    # committed right now, never what the generator would actually produce next. Closed by
    # running the generator itself (fixture data, no DB) through the same checker.
    name: Static Page Overflow (no clipped tables/pre)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Self-test the checker itself
        run: python3 scripts/check-no-clipped-overflow.py --selftest

      - name: Every <table>/<pre> in static/*.html has a horizontal-scroll wrapper
        run: python3 scripts/check-no-clipped-overflow.py

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: gen-catalog-page.ts itself (not just its last committed output) satisfies the invariant
        run: |
          npx tsx scripts/gen-catalog-page.ts --print > /tmp/catalog-dry-run.html
          python3 scripts/check-no-clipped-overflow.py /tmp/catalog-dry-run.html

  static-tool-refs:
    # F5: connect.html's starter example called `tools/coingecko.get_price/call`,
    # which does not exist -- the real id is `crypto.get_price`. Nothing compared
    # what static/*.html tells visitors to call against the real tool catalog.
    name: Static Page Tool References
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: Every tools/<id>/call reference in static/*.html is a real tool_id
        run: npx tsx scripts/check-static-tool-refs.ts

  static-dashboard-english-only:
    # T-00 (2026-09-04): the operator found ~85 live Russian text fragments on
    # https://apibase.pro/dashboard (and /autopilot/incident) -- headings, empty
    # states, legends, and error texts that only render once something has
    # already failed. Ruling: the autopilot dashboard UI is English-only. Static
    # check on the committed static/*.html (no build step, nginx serves them
    # byte-for-byte -- see the script's own header) so the next commit can't
    # silently reintroduce Cyrillic the way this one did.
    name: Static Dashboard English-Only
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Self-test the checker itself
        run: python3 scripts/check-english-only-static.py --selftest

      - name: static/dashboard.html + static/autopilot-incident.html contain no Cyrillic
        run: python3 scripts/check-english-only-static.py

  static-counts-drift:
    # F9: sync-counts.sh --check was written FOR CI but wired to nothing -- zero
    # references in any workflow or cron. It needs the live production DB (docker exec
    # into postgres), so a GH-hosted runner reaches it the same way deploy.yml reaches
    # the server: over SSH. Read-only (--check writes nothing); the self-heal (no
    # --check) side lives in the daily crontab instead, not here -- a CI job should
    # report drift, not silently fix production files on every push.
    name: Static Counts Drift
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    steps:
      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      - name: sync-counts.sh --check against the live server
        run: |
          ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.SERVER_HOST }} \
            "cd /home/apibase/apibase && bash scripts/sync-counts.sh --check"

      - name: Cleanup SSH key
        if: always()
        run: rm -f ~/.ssh/deploy_key

  external-listings-advisory:
    # 2026-09-02: split out of static-counts-drift per Fable's ruling on T-30 dispute q-1
    # (Q2 — disputes/30-content-seo-and-github.ruling-1.md). sync-counts.sh only ever
    # compared OUR OWN surfaces against the DB -- it has no way to see a third-party
    # site's cached copy of our tool count, which is exactly how the Smithery listing sat
    # at "95 tools" (live: 1316) with sync-counts reporting "0 drift" the whole time.
    # This job is that missing half, with its own name so its failure class is visibly
    # distinct from an internal-surface drift: a defect no commit here can fix must not
    # look, in the Actions UI, like one that a commit here broke.
    #
    # "Advisory" does not mean "never red" -- check-external-listings.sh classifies each
    # listing repo-fixable (always blocking) vs operator-only (blocking only once
    # docs/external-drift.json's first_seen for it is >30 days old — see the script's own
    # header for the full predicate). A ledger nobody reads because it never turns red
    # again is the same failure mode as a check that's always red; this is the middle
    # path: quiet while it's fresh and actionable, loud if it gets ignored.
    name: External listings (advisory)
    runs-on: ubuntu-latest
    if: github.event_name != 'pull_request'
    permissions:
      issues: write
    steps:
      - uses: actions/checkout@v5

      # 2026-09-02, found live on this job's own first real run: `gh issue create --label
      # external-drift` fails with "could not add label: 'external-drift' not found" if the
      # label doesn't exist yet -- and the report step below deliberately uses check=False
      # (a GitHub-side hiccup here must not fail the whole job), which means a missing label
      # silently ate the issue-creation step entirely. Idempotent: the API 422s harmlessly
      # if the label already exists.
      - name: Ensure the external-drift label exists
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh api "repos/${{ github.repository }}/labels" -f name="external-drift" \
            -f color="d93f0b" \
            -f description="Third-party listing text disagrees with live truth (see check-external-listings.sh)" \
            >/dev/null 2>&1 || true

      - name: Setup SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.SSH_KEY }}" > ~/.ssh/deploy_key
          chmod 600 ~/.ssh/deploy_key
          ssh-keyscan -H ${{ secrets.SERVER_HOST }} >> ~/.ssh/known_hosts 2>/dev/null

      - name: External listings drift (Smithery, etc.) against the live server
        id: check
        run: |
          set +e
          OUTPUT=$(ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no \
            ${{ secrets.DEPLOY_USER }}@${{ secrets.SERVER_HOST }} \
            "cd /home/apibase/apibase && bash scripts/check-external-listings.sh")
          RC=$?
          echo "$OUTPUT"
          {
            echo 'json<<DRIFT_EOF'
            echo "$OUTPUT"
            echo 'DRIFT_EOF'
          } >> "$GITHUB_OUTPUT"
          exit $RC

      - name: Cleanup SSH key
        if: always()
        run: rm -f ~/.ssh/deploy_key

      # Runs on the Actions runner (not over SSH) because it needs gh/GITHUB_TOKEN,
      # which belong here, not on the production box. Reads the JSON-per-line output
      # from the check step above; the check step's own exit code is what actually
      # fails this job (see `if: always()` + exit-code re-check at the end) -- this step
      # ONLY handles visibility (warning annotation, job summary, tracking issue).
      - name: Report drift (warning annotation, summary, tracking issue)
        if: always()
        env:
          GH_TOKEN: ${{ github.token }}
          DRIFT_JSON: ${{ steps.check.outputs.json }}
        run: |
          python3 - <<'PYEOF'
          import json, os, subprocess

          raw = os.environ.get("DRIFT_JSON", "")
          summary_lines = ["## External listings drift\n", "| Listing | Status | Live | Listed | Blocking |", "|---|---|---|---|---|"]
          any_drift = False
          for line in raw.splitlines():
              line = line.strip()
              if not line.startswith("{"):
                  continue
              try:
                  rec = json.loads(line)
              except json.JSONDecodeError:
                  continue
              if "error" in rec:
                  print(f"::error::{rec['error']}")
                  continue
              listing = rec.get("listing", "?")
              status = rec.get("status", "?")
              live = rec.get("live_tools", "-")
              listed = rec.get("listing_value", "-")
              blocking = rec.get("blocking", False)
              summary_lines.append(f"| {listing} | {status} | {live} | {listed} | {blocking} |")

              issue_title = f"external-drift: {listing}"
              if status == "drift":
                  any_drift = True
                  age = rec.get("age_days", "?")
                  cls = rec.get("classification", "?")
                  msg = (f"{listing} listing says '{listed}', live truth is {live} tools "
                         f"(classification={cls}, first_seen age={age}d, blocking={blocking})")
                  print(f"::warning::{msg}")
                  # find or create the open tracking issue
                  found = subprocess.run(
                      ["gh", "issue", "list", "--label", "external-drift", "--state", "open",
                       "--search", issue_title, "--json", "number,title", "-q", ".[].number"],
                      capture_output=True, text=True,
                  )
                  numbers = [n for n in found.stdout.split() if n.strip()]
                  body = (f"Automated tracking issue (check-external-listings.sh). Do not edit "
                          f"manually beyond adding notes — this reopens/updates itself.\n\n{msg}\n\n"
                          f"Fix: see docs/OPERATOR-ACTION-smithery-listing-description.md "
                          f"(or the equivalent doc for a non-Smithery listing).")
                  if numbers:
                      subprocess.run(["gh", "issue", "comment", numbers[0], "--body", body], check=False)
                  else:
                      subprocess.run(
                          ["gh", "issue", "create", "--title", issue_title, "--body", body,
                           "--label", "external-drift"],
                          check=False,
                      )
              elif status in ("unhealthy", "pending_republish", "wrong_content"):
                  # visible but no tracking issue -- these statuses already have their own
                  # doc/ledger (docs/external-drift.json, docs/OPERATOR-ACTION-registry-
                  # listings.md), unlike "drift" which relies on the auto-issue as its
                  # only record. Annotation only, so they aren't silently buried in the
                  # job summary table that nobody reads.
                  age = rec.get("age_days", "?")
                  cls = rec.get("classification", "?")
                  msg = f"{listing} status={status} (classification={cls}, first_seen age={age}d, blocking={blocking})"
                  print(f"::warning::{msg}")
              elif status in ("ok", "ok_no_number"):
                  # zero drift -- close any open tracking issue for this listing.
                  found = subprocess.run(
                      ["gh", "issue", "list", "--label", "external-drift", "--state", "open",
                       "--search", issue_title, "--json", "number", "-q", ".[].number"],
                      capture_output=True, text=True,
                  )
                  for num in found.stdout.split():
                      if num.strip():
                          subprocess.run(
                              ["gh", "issue", "close", num.strip(), "--comment",
                               f"Resolved: {listing} listing now matches live truth (or carries no stale number)."],
                              check=False,
                          )

          with open(os.environ["GITHUB_STEP_SUMMARY"], "a") as f:
              f.write("\n".join(summary_lines) + "\n")
          PYEOF

      - name: Fail if any listing is currently blocking
        if: always()
        run: |
          if echo '${{ steps.check.outputs.json }}' | grep -q '"blocking": *true'; then
            echo "::error::At least one external listing's drift has crossed its blocking threshold — see the job summary/issue."
            exit 1
          fi
          exit 0

  lint:
    name: Code Quality
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: Generate Prisma client
        run: npx prisma generate

      - name: ESLint
        run: npm run lint

  dead-exports:
    # Report-only since 2026-09-01 (Fable-approved gate, F1 follow-up):
    # finalizeIdempotency() sat unused for a real request cycle before anyone
    # noticed — an exported function nothing calls is exactly the class of
    # bug this catches. One week of report-only lets the existing 36-item
    # baseline (see knip.json) get triaged without breaking unrelated PRs;
    # after 2026-09-08 this step should drop "|| true" and start failing on
    # NEW unused exports (a checked-in baseline count, or --include exports
    # with a per-item allowlist, whichever is smaller at the time).
    name: Dead Exports (knip, report-only)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5

      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: "20"
          cache: "npm"

      - name: Install dependencies
        run: npm ci --ignore-scripts --legacy-peer-deps

      - name: Generate Prisma client
        run: npx prisma generate

      - name: knip — unused exports (report-only, see comment above)
        run: npx knip --include exports || true