DevSecOps

name: CI

on: [push]

jobs:
  sast_scan:
    name: Run Bandit Scan
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: '3.8'

      - name: Install Bandit
        run: pip install bandit

      - name: Run Bandit Scan
        run: bandit -ll -ii -r . -f json -o bandit-report.json

      - name: Upload Artifact
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: bandit-findings.json
          path: bandit-report.json

  image_scan:
    name: Build and Run Image Scan
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Fix Docker DNS
        run: |
          echo '{"dns": ["8.8.8.8", "1.1.1.1"]}' | sudo tee /etc/docker/daemon.json
          sudo systemctl restart docker

      - name: Build Docker Image
        run: docker build -f Dockerfile -t mytestapp:latest .

      - name: Docker Scout Scan
        uses: docker/scout-action@v1.15.1
        with:
          dockerhub-user: ${{ secrets.DOCKERHUB_USERNAME }}
          dockerhub-password: ${{ secrets.DOCKERHUB_PASSWORD }}
          command: quickview,cves
          only-severities: critical,high
          sarif-file: scout-report.sarif
          exit-code: true

      - name: Upload Artifact
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: docker-scout-findings
          path: scout-report.sarif

  dast_scan:
    name: Deploy and Run DAST Scan with Nikto
    runs-on: ubuntu-latest

    steps:
      - name: Checkout My Repository
        uses: actions/checkout@v6

      - name: Install System Dependencies and Nikto
        run: |
          sudo apt-get update
          sudo apt-get install -y libjpeg-dev zlib1g-dev libpq-dev python3-dev nikto

      - name: Set up Python for DAST
        uses: actions/setup-python@v6
        with:
          python-version: '3.12'

      - name: Install Python Requirements
        run: |
          python -m pip install --upgrade pip
          pip install -r requirements.txt

      - name: Apply Migrations
        run: python3 manage.py migrate

      - name: Run Server
        run: nohup python3 manage.py runserver 0.0.0.0:8000 &

      - name: Wait for Server to Start
        run: sleep 10

      - name: Check Server Availability
        run: curl -I http://127.0.0.1:8000

      - name: Run Nikto Scan
        run: |
          nikto -h http://127.0.0.1:8000 -o nikto-report.html -Format html || true

      - name: Verify Nikto Report File
        run: ls -la

      - name: Upload Artifact
        uses: actions/upload-artifact@v6
        if: always()
        with:
          name: nikto-report
          path: nikto-report.html

stages:
  - sast
  - image_scan
  - dast

sast_scan:
  stage: sast
  image: python:3.8
  script:
    - pip install bandit
    - bandit -ll -ii -r . -f json -o bandit-report.json
  artifacts:
    paths:
      - bandit-report.json
    when: always

image_scan:
  stage: image_scan
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind
  script:
    - docker build -f Dockerfile -t mytestapp:latest .
    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image mytestapp:latest > trivy-report.txt
  artifacts:
    paths:
      - trivy-report.txt
    when: always

dast_scan:
  stage: dast
  image: python:3.12
  script:
    - apt-get update && apt-get install -y nikto
    - pip install -r requirements.txt
    - python3 manage.py migrate
    - nohup python3 manage.py runserver 0.0.0.0:8000 &
    - sleep 10
    - nikto -h http://127.0.0.1:8000 -o nikto-report.html -Format html || true
  artifacts:
    paths:
      - nikto-report.html
    when: always