Vulnerability Management

name: Scan CDE Templates

on:
  push:
    paths: ['templates/**']
  schedule:
    - cron: '0 6 * * *'  # Daily at 6 AM

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/[email protected]
        with:
          scan-type: 'config'
          scan-ref: 'templates/'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Scan container images in templates
        run: |
          for dockerfile in templates/*/build/Dockerfile; do
            trivy image --severity HIGH,CRITICAL \
              --exit-code 1 \
              $(grep "^FROM" $dockerfile | head -1 | awk '{print $2}')
          done

      - name: Run Semgrep for AI-generated code patterns
        uses: semgrep/semgrep-action@v1
        with:
          config: >-
            p/default
            p/owasp-top-ten
            p/ai-code-review
          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

# External Secrets for Vault integration
resource "kubernetes_manifest" "workspace_secrets" {
  manifest = {
    apiVersion = "external-secrets.io/v1beta1"
    kind       = "ExternalSecret"
    metadata = {
      name      = "workspace-${data.coder_workspace.me.name}-secrets"
      namespace = var.namespace
    }
    spec = {
      refreshInterval = "1h"
      secretStoreRef = {
        name = "vault-backend"
        kind = "ClusterSecretStore"
      }
      target = {
        name = "workspace-secrets"
      }
      data = [
        {
          secretKey = "npm_token"
          remoteRef = {
            key      = "secret/data/dev/${data.coder_workspace_owner.me.name}"
            property = "npm_token"
          }
        },
        {
          secretKey = "github_token"
          remoteRef = {
            key      = "secret/data/dev/${data.coder_workspace_owner.me.name}"
            property = "github_token"
          }
        }
      ]
    }
  }
}

# Mount secrets in workspace pod
resource "kubernetes_pod" "workspace" {
  # ... other config ...
  spec {
    container {
      volume_mount {
        name       = "secrets"
        mount_path = "/run/secrets"
        read_only  = true
      }
    }
    volume {
      name = "secrets"
      secret {
        secret_name = "workspace-secrets"
      }
    }
  }
}