langsmith-data-migration-tool/.github/workflows/security.yml

name: Security

on:
  pull_request:
    branches: [ main ]
  push:
    branches: [ main ]

permissions:
  contents: read

jobs:
  security-checks:
    name: Security Gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install uv
        uses: astral-sh/setup-uv@v7
        with:
          version: "latest"

      - name: Install tools
        run: pip install detect-secrets pip-licenses

      - name: Install project dependencies
        run: uv sync

      # Secret Detection
      - name: Run detect-secrets
        run: |
          detect-secrets scan --baseline .secrets.baseline || detect-secrets scan > .secrets.baseline.new
          if [ -f .secrets.baseline ]; then
            detect-secrets audit --report --baseline .secrets.baseline || true
          fi

      - name: Check for new secrets
        run: |
          if [ -f .secrets.baseline.new ]; then
            NEW_SECRETS=$(python3 -c "import json; data=json.load(open('.secrets.baseline.new')); print(len(data.get('results', {})))")
            if [ "$NEW_SECRETS" -gt 0 ]; then
              echo "::error::Found $NEW_SECRETS potential secrets in codebase"
              cat .secrets.baseline.new | python3 -m json.tool
              exit 1
            fi
          fi

      # License Compliance
      - name: Check licenses
        run: |
          source .venv/bin/activate
          pip-licenses --format=json --output-file=licenses.json

          COPYLEFT=$(python3 -c "
          import json
          data = json.load(open('licenses.json'))
          copyleft_licenses = ['GPL', 'AGPL', 'LGPL', 'SSPL', 'OSL']
          problematic = []
          for pkg in data:
              license_name = pkg.get('License', '').upper()
              for cl in copyleft_licenses:
                  if cl in license_name and 'EXCEPTION' not in license_name:
                      problematic.append(f\"{pkg['Name']}: {pkg['License']}\")
          print(len(problematic))
          if problematic:
              print('Problematic packages:', file=__import__('sys').stderr)
              for p in problematic:
                  print(f'  - {p}', file=__import__('sys').stderr)
          ")

          if [ "$COPYLEFT" -gt 0 ]; then
            echo "::error::Found $COPYLEFT packages with copyleft licenses"
            exit 1
          fi

          echo "All licenses are compliant"