From 755bbfd804d476a5369408ff94bf25a166ac1e99 Mon Sep 17 00:00:00 2001
From: carsonchan12345 <44266907+carsonchan12345@users.noreply.github.com>
Date: Wed, 8 Oct 2025 22:30:28 +0100
Subject: [PATCH] Split security scans into dedicated workflows (#2)

* Split AppSec workflows by scan type

* Refine security workflows

* Remove deprecated TruffleHog no-update flag

* Switch dependency audit to OWASP Dependency-Check

* Update dependency audit workflow action version
---
 .github/workflows/appsec-codeql.yml           | 39 ++++++++++++
 .github/workflows/appsec-dependency-audit.yml | 60 +++++++++++++++++++
 .github/workflows/appsec-secrets.yml          | 26 ++++++++
 3 files changed, 125 insertions(+)
 create mode 100644 .github/workflows/appsec-codeql.yml
 create mode 100644 .github/workflows/appsec-dependency-audit.yml
 create mode 100644 .github/workflows/appsec-secrets.yml

diff --git a/.github/workflows/appsec-codeql.yml b/.github/workflows/appsec-codeql.yml
new file mode 100644
index 0000000..6c3cfb1
--- /dev/null
+++ b/.github/workflows/appsec-codeql.yml
@@ -0,0 +1,39 @@
+name: CodeQL Analysis
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  schedule:
+    - cron: '0 3 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'python' ]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:${{ matrix.language }}'
diff --git a/.github/workflows/appsec-dependency-audit.yml b/.github/workflows/appsec-dependency-audit.yml
new file mode 100644
index 0000000..1b78acb
--- /dev/null
+++ b/.github/workflows/appsec-dependency-audit.yml
@@ -0,0 +1,60 @@
+name: Dependency Audit
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  schedule:
+    - cron: '0 3 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  dependency-check:
+    name: OWASP Dependency-Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run OWASP Dependency-Check
+        id: dependency_check
+        uses: dependency-check/Dependency-Check_Action@1.1.0
+        continue-on-error: true
+        with:
+          project: AutoRecon
+          path: .
+          format: 'SARIF'
+          out: reports
+          args: >
+            --format JSON
+            --failOnCVSS 0
+
+      - name: Upload Dependency-Check results
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: reports/dependency-check-report.sarif
+
+      - name: Evaluate Dependency-Check results
+        if: always()
+        env:
+          DEPENDENCY_CHECK_OUTCOME: ${{ steps.dependency_check.outcome }}
+        run: |
+          if [ -f reports/dependency-check-report.json ]; then
+            vulnerabilities=$(jq '[.dependencies[]? | (.vulnerabilities // []) | length] | add // 0' reports/dependency-check-report.json)
+          else
+            vulnerabilities=0
+          fi
+
+          if [ "$vulnerabilities" -gt 0 ]; then
+            echo "::error::OWASP Dependency-Check detected $vulnerabilities vulnerable dependency occurrences. Review the 'Dependency Audit' workflow run for details."
+            exit 1
+          fi
+
+          if [ "$DEPENDENCY_CHECK_OUTCOME" = "failure" ]; then
+            echo "::error::OWASP Dependency-Check failed to complete successfully. Review the 'Dependency Audit' workflow logs for diagnostics."
+            exit 1
+          fi
diff --git a/.github/workflows/appsec-secrets.yml b/.github/workflows/appsec-secrets.yml
new file mode 100644
index 0000000..d546d0c
--- /dev/null
+++ b/.github/workflows/appsec-secrets.yml
@@ -0,0 +1,26 @@
+name: Secret Scanning
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  schedule:
+    - cron: '0 3 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    name: TruffleHog Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run TruffleHog
+        uses: trufflesecurity/trufflehog@v3.90.8
+        with:
+          path: .
+          base: origin/main
+          head: ${{ github.sha }}