security.yml

name: Security & Quality

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true

jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Run lint
        run: ./gradlew lintRelease

  dependency-check:
    name: Dependency Security Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Java 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Check for dependency vulnerabilities
        run: ./gradlew dependencies --configuration releaseRuntimeClasspath | tee deps.txt

      - name: Scan dependencies with Gradle
        run: |
          echo "Checking for known vulnerable dependency versions..."
          VULNERABLE=0
          # Check for known vulnerable versions (add patterns as CVEs are discovered)
          if grep -qE 'okhttp:4\.(11|10|9)\.' deps.txt 2>/dev/null; then
            echo "::warning::OkHttp version may have known vulnerabilities"
            VULNERABLE=1
          fi
          if grep -qE 'retrofit:2\.(0|1|2|3|4|5|6|7|8|9)\.' deps.txt 2>/dev/null; then
            echo "::warning::Retrofit version may have known vulnerabilities"
            VULNERABLE=1
          fi
          echo "Dependency check completed (warnings: $VULNERABLE)"