Dependency scan with Droid Exec

name: Droid dependency and secret scan
 
on:
  schedule:
    - cron: '0 9 * * 1' # Mondays at 09:00 UTC
  workflow_dispatch:
 
permissions:
  contents: read
 
jobs:
  scan:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      changed: ${{ steps.patch.outputs.changed }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
 
      - name: Install Droid CLI
        run: |
          curl -fsSL https://app.factory.ai/cli | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
      - name: Secret sweep (read-only)
        continue-on-error: true
        env:
          FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
        run: |
          droid exec "Scan the tracked files in this repository for committed
          secrets: API keys, tokens, private keys, passwords, and connection
          strings. Ignore obvious placeholders and test fixtures.
          For each finding, report the file, line, and type of secret.
          Never print the secret value itself.
          Respond with a Markdown list, or 'No secrets found.'" \
            > secret-report.md
 
      - name: Upload secret report
        uses: actions/upload-artifact@v7
        with:
          name: secret-report
          path: secret-report.md
          retention-days: 14
 
      # npm audit reads the lockfile and runs no package scripts.
      - name: Audit dependencies
        id: audit
        run: |
          npm audit --json > audit.json || true
          if ! jq -e '.metadata.vulnerabilities' audit.json > /dev/null; then
            reason=$(jq -r '.error.summary // "no audit results"' \
              audit.json 2>/dev/null || true)
            echo "::error::npm audit failed: $reason"
            exit 1
          fi
          total=$(jq '.metadata.vulnerabilities.total // 0' audit.json)
          echo "total=$total" >> "$GITHUB_OUTPUT"
 
      - name: Propose upgrades
        if: steps.audit.outputs.total != '0'
        env:
          FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
        run: |
          droid exec --auto low "Read audit.json, the output of npm audit.
          For each vulnerable direct dependency, change its version in
          package.json to the lowest version that fixes the vulnerability.
          For a vulnerable transitive dependency, add an overrides entry.
          Avoid major version upgrades unless they are the only fix; list
          those in the report instead of applying them. Do not edit the
          lockfile.
          Only read and edit files. Do not run shell commands. A later job
          updates the lockfile and runs the tests, so don't list those as
          follow-ups. Write a summary of the vulnerabilities, the changes you
          made, and what still needs a human to dependency-report.md." \
            || echo "::warning::droid exec exited $?. Keeping its edits."
 
      - name: Save changes
        id: patch
        run: |
          git add package.json
          git diff --cached --binary > changes.patch
          if [ -s changes.patch ]; then
            echo "changed=true" >> "$GITHUB_OUTPUT"
          fi
 
      - name: Upload dependency report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: dependency-report
          path: |
            dependency-report.md
            audit.json
          if-no-files-found: warn
          retention-days: 14
 
      - name: Flag unresolved vulnerabilities
        if: >-
          steps.audit.outputs.total != '0' &&
          steps.patch.outputs.changed != 'true'
        env:
          TOTAL: ${{ steps.audit.outputs.total }}
        run: |
          if [ -f dependency-report.md ]; then
            cat dependency-report.md >> "$GITHUB_STEP_SUMMARY"
          fi
          echo "::error::npm audit found $TOTAL vulnerabilities Droid" \
            "couldn't fix. See the dependency-report artifact."
          exit 1
 
      - uses: actions/upload-artifact@v7
        if: steps.patch.outputs.changed == 'true'
        with:
          name: droid-changes
          path: |
            changes.patch
            dependency-report.md
 
  verify:
    needs: scan
    if: needs.scan.outputs.changed == 'true'
    runs-on: ubuntu-latest
    outputs:
      tests: ${{ steps.test.outputs.result }}
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
 
      - uses: actions/download-artifact@v8
        with:
          name: droid-changes
 
      # Add your runtime setup here, such as actions/setup-node.
      - name: Update lockfile without running package scripts
        run: |
          git apply changes.patch
          npm install --package-lock-only --ignore-scripts
          git add package.json package-lock.json
          git diff --cached --binary > verified.patch
 
      - uses: actions/upload-artifact@v7
        with:
          name: droid-verified
          path: |
            verified.patch
            dependency-report.md
 
      - name: Install and test without credentials
        id: test
        run: |
          if npm ci && npm test; then result=passed; else result=failed; fi
          echo "result=$result" >> "$GITHUB_OUTPUT"
 
  open-pr:
    needs: verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          token: ${{ secrets.PR_TOKEN }}
 
      - uses: actions/download-artifact@v8
        with:
          name: droid-verified
 
      - name: Open pull request
        env:
          GH_TOKEN: ${{ secrets.PR_TOKEN }}
          TESTS: ${{ needs.verify.outputs.tests }}
        run: |
          touch dependency-report.md
          git apply verified.patch
          branch="droid/dependency-updates-$(date +%Y%m%d)-$GITHUB_RUN_ID"
          git config user.name "github-actions[bot]"
          git config user.email \
            "41898282+github-actions[bot]@users.noreply.github.com"
          git checkout -b "$branch"
          git add package.json package-lock.json
          git commit -m "chore(deps): weekly security updates"
          git push -u origin "$branch"
          draft=false
          if [ "$TESTS" != "passed" ]; then
            draft=true
            cat >> dependency-report.md <<'EOF'
 
          Install or tests failed for these upgrades in the verify job.
          Check the workflow run before you mark this ready.
          EOF
          fi
          gh pr create --draft="$draft" \
            --title "Weekly dependency security updates" \
            --body-file dependency-report.md