# 🛡️ Enterprise-Grade Quality & Security Pipeline (Zero Cost Stack)

Goal: Reach a “large-company / regulated-industry” assurance level using ONLY free / OSS tooling + GitHub native features. Everything here is additive to what you already have (CodeQL, Trivy, Lighthouse, audits, branch protection, security autofix).

1. Enable SBOM generation (Syft + CycloneDX) – attach as artifact
2. Add gitleaks secrets scan (fail on HIGH after allowlist)
3. Add Semgrep OSS rules (informational fail → warn first 7 days)
4. osv-scanner for dependency vulns beyond npm advisory DB
5. ZAP Baseline scan against ephemeral dev server (non-blocking initially)
6. Coverage quality gate (e.g., global >= 70%, critical dirs >= 80%)

7. Policy-as-code (Conftest) to enforce: min coverage, no GPL licenses, max CVSS threshold
8. License compliance from SBOM (fail on disallowed license list)
9. Mutation testing (Stryker) on auth/session modules weekly (separate workflow)
10. Property-based tests (fast-check) for critical pure functions (signing / cookie parsing)
11. Parallel matrix for Node LTS + current to surface runtime drift

12. Build provenance: publish SHA256 checksums + optional SLSA generator (when needed)
13. Flake tracker: parse test timing → flag > p95 duration increases
14. Risk scoring job combining: open vulns (SCA), secrets incidents, coverage deltas, mutation score → single badge / comment
15. Scheduled deep Semgrep + SAST variant job (weekly, more rules)
16. Fuzzing harness (if parsers / structured decoding added later)

name: ci-enterprise

trigger: PR + main

Jobs (fast first < 8m):
  1. prepare (restore caches, generate SBOM early) [<2m]
  2. lint+type (ESLint / TS) [parallel]
  3. unit (Vitest) → coverage upload
  4. integration (Vitest+MSW)
  5. e2e-smoke (Playwright single browser) PR only; full matrix on main

Security Lane (starts after prepare; in parallel):
  A. codeql (existing)
  B. semgrep (informational → gating later)
  C. dependencies (npm audit + osv-scanner)
  D. secrets (gitleaks)
  E. container (Trivy) – existing
  F. sbom (Syft + CycloneDX) + license filtering via Conftest

DAST Lane:
  - spin ephemeral server (Astro) → ZAP Baseline (non-blocking) → artifact HTML report

Policy Gate Aggregator:
  - Collect JSON outputs from: coverage, semgrep, osv, trivy, gitleaks, license scan
  - Evaluate OPA policies; fail build if hardened phase active

NOTE: Always pin actions to commit SHAs (as done in existing workflows) to prevent supply-chain drift.

package ci.policy

deny[msg] {
  input.coverage.global < 0.70
  msg := sprintf("Insufficient coverage: %.2f%%", [input.coverage.global*100])
}

deny[msg] {
  count(input.sca.high) > 0
  msg := "High severity dependency vulnerabilities present"
}

deny[msg] {
  some v in input.secrets.findings
  v.severity == "HIGH"
  msg := "High severity secret exposure detected"
}

All scanners emit JSON → aggregator consolidates → opa eval -I → pass/fail.

1. Reuse caches (npm, Playwright browsers) keyed on lockfiles
2. Split fast lane (<10m) vs deep lane (runs on schedule)
3. Convert rarely changing scans (e.g., mutation) to weekly
4. Only run full Playwright matrix on main or nightly; PRs get smoke subset
5. Use concurrency: { group: pr-number, cancel-in-progress: true } to avoid queue storms

Composite = weighted( vulns, secrets, coverage delta, mutation score, DAST alerts ). Produces badge risk: low/medium/high.

• Continue pinning all actions by commit SHA (already followed)
• Use permissions: read-all then elevate per job
• Protect main with required status checks (aggregated gate job)
• Optionally enforce signed commits / provenance later

#!/usr/bin/env bash
set -euo pipefail

jq -n \
  --slurpfile cover coverage/coverage-summary.json \
  --slurpfile semgrep semgrep.json \
  --slurpfile osv osv.json \
  --slurpfile gitleaks gitleaks.json \
  --slurpfile trivy trivy.json \
  '{coverage:{global: ($cover[0].total.lines.pct/100)}, semgrep:$semgrep[0], osv:$osv[0], secrets:$gitleaks[0], container:$trivy[0]}' > aggregate.json

opa eval --fail-defined -I -d policy/ -i aggregate.json 'data.ci.policy'

You reach diminishing returns once: high-risk code is covered & mutated; zero critical vulns; no secrets incidents; SBOM + license stable; DAST baseline clean. Focus then shifts to runtime observability + SLO based quality signals.

This blueprint yields an enterprise-grade, defense-in-depth quality and security posture without paid products, leveraging GitHub + curated OSS scanners, with progressive enforcement to avoid developer friction.