codeql-simple.yml

name: "Security Scan (Simple)"

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read

jobs:
  security-scan:
    name: Security Scan
    runs-on: ubuntu-latest
    # Only run on main repository to avoid permission issues
    if: github.repository_owner == 'securebitsorg' || github.event_name != 'pull_request'

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Install system dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y python3-tk python3-pip zenity xterm

    - name: Install Python dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt
        pip install bandit safety

    - name: Run Bandit security scan
      run: |
        bandit -r bash_script_maker.py syntax_highlighter.py -f json -o bandit-results.json || true
        cat bandit-results.json | jq '.results' || echo "No critical issues found"

    - name: Run Safety dependency check
      run: |
        safety check --file requirements.txt || echo "Safety check completed with warnings"

    - name: Upload security results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: security-scan-results
        path: |
          bandit-results.json
        retention-days: 30