Moltbot DevSecOps Pipeline: Security im CI/CD von Anfang an

# .github/workflows/moltbot-security.yml
name: Moltbot Security Pipeline

on: [push, pull_request]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # 1. Dependency Vulnerability Scan
      - name: npm audit
        run: npm audit --audit-level=high

      # 2. SAST — Static Application Security Testing
      - name: CodeQL Analysis
        uses: github/codeql-action/analyze@v3
        with:
          languages: javascript, typescript

      # 3. Secrets Detection
      - name: TruffleHog Secrets Scan
        uses: trufflesecurity/trufflehog@main
        with:
          path: ./
          base: BRANCH_NAME

      # 4. Container Scan
      - name: Build Docker image
        run: docker build -t moltbot:COMMIT_SHA .

      - name: Trivy Container Scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: moltbot:COMMIT_SHA
          severity: CRITICAL,HIGH
          exit-code: 1

      # 5. DAST — Dynamic Security Testing (nur auf Staging)
      - name: OWASP ZAP Scan
        if: github.ref == refs/heads/staging
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: https://staging.clawguru.org
# Hinweis: Ersetze COMMIT_SHA mit github.sha und BRANCH_NAME mit github.event.repository.default_branch