name: Governed security review
on:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  security-and-evidence:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Run repository-local security checks
        run: |
          python -m pip install --disable-pip-version-check bandit cyclonedx-bom
          mkdir -p out/security
          bandit -r . -f json -o out/security/bandit.json
          cyclonedx-py environment -o out/security/sbom.cdx.json
      - name: Bind evidence to MetaSolve release decision
        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
        env:
          METASOLVE_API_KEY: ${{ secrets.METASOLVE_API_KEY }}
        run: |
          python scripts/ci/metasolve_vaas_verify.py \
            --sbom-path out/security/sbom.cdx.json \
            --runtime-config-path static/downloads/code-zone/metasolve-config.yaml \
            --policy-id ORG-SECURE-RELEASE \
            --policy-version 1.0 \
            --clause-id APPSEC-GATE \
            --policy-approval-status Approved \
            --environment staging \
            --fail-on blocked
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: security-and-metasolve-evidence
          path: out/
          retention-days: 90
# Vendor scripts/ci/metasolve_vaas_verify.py or pin the MetaSolve action in your repository.
# Never expose METASOLVE_API_KEY to untrusted fork workflows.
