feat(ci): add comprehensive security testing workflows

[arunsanna]

Summary

• Implemented 7 new security testing workflows for comprehensive security coverage
• All workflows follow OSS-only approach without external dependencies
• Each workflow runs independently with proper error handling

Security Workflows Added

1. security-dependencies.yml - Dependency Vulnerability Scanning

• npm audit for frontend and backend
• Checks for critical/high vulnerabilities
• Generates dependency security reports
• Fails only on critical vulnerabilities

2. security-containers.yml - Container Security

• Trivy and Grype vulnerability scanners
• Scans both frontend and backend Docker images
• Checks for OS and library vulnerabilities
• Analyzes Dockerfile security configuration

3. security-frontend.yml - Frontend Security Testing

• ESLint security plugin analysis
• XSS vulnerability detection
• Sensitive data exposure checks
• Bundle security analysis

4. security-backend.yml - Backend Security Testing

• SQL injection vulnerability checks
• Authentication security analysis
• Hardcoded secrets detection
• Security middleware verification

5. security-owasp-zap.yml - OWASP ZAP Dynamic Testing

• Baseline security scan for frontend
• API security scan for backend
• Automated penetration testing
• Runs weekly on main branch

6. security-headers.yml - Security Headers & Configuration

• Tests security headers (CSP, HSTS, X-Frame-Options)
• CORS configuration testing
• Rate limiting verification
• Cookie security analysis

7. security-report.yml - Consolidated Security Reporting

• Aggregates all security test results
• Generates comprehensive security summary
• Creates OWASP Top 10 compliance checklist
• Provides actionable recommendations

Key Features

✅ All workflows use continue-on-error: true for non-blocking execution
✅ Port conflict prevention with unique ports per job
✅ Comprehensive artifact collection
✅ OSS-only approach (no Codecov, no external services)
✅ Clear security status reporting in GitHub Summary

Testing Strategy

• Each workflow can be triggered via workflow_dispatch
• Scheduled runs for continuous security monitoring
• PR and push triggers for relevant file changes

Next Steps

After merge:

1. Workflows will be available for manual triggering
2. Scheduled scans will begin automatically
3. Security reports will be generated and stored as artifacts

[Copilot]

Pull Request Overview

This PR adds comprehensive security testing workflows to the CI/CD pipeline using an OSS-only approach. The implementation includes 7 new security workflows covering dependency scanning, container security, frontend/backend security analysis, OWASP ZAP testing, security headers validation, and consolidated reporting.

Key changes implemented:

• Security testing workflows for comprehensive coverage across all application layers
• TypeScript error fixes in frontend components to improve code quality and type safety
• Enhanced accessibility testing with multiple testing suites (Lighthouse, Axe-core, WAVE, etc.)

Reviewed Changes

Copilot reviewed 28 out of 29 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/security-*.yml	Seven new security testing workflows for comprehensive vulnerability scanning
.github/workflows/test-*.yml	Updated frontend and backend testing workflows with improved error handling
.github/workflows/accessibility.yml	Comprehensive accessibility testing with multiple test suites
frontend/src/**/*.ts	TypeScript error fixes including null safety, type annotations, and import paths
package.json	Added optional dependency for Rollup platform-specific build
.github/codecov.yml	Codecov configuration for coverage reporting

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] The placeholderData option should use keepPreviousData for better type safety and consistency with React Query v4+ API. Consider using placeholderData: keepPreviousData instead of the arrow function approach.

Suggested change

	placeholderData: previousData => previousData,
	keepPreviousData: true,

[Copilot]

Changing from specific union type 'user' | 'admin' | 'moderator' to generic 'string' reduces type safety. This allows any string value for role, which could lead to runtime errors. Consider keeping the union type or creating a more specific type constraint.

Suggested change

	role: string;
	role: 'user' | 'admin' | 'moderator';

[Copilot]

Using || true suppresses all exit codes from TruffleHog, including legitimate failures. This could mask actual security scanning errors. Consider handling specific exit codes (like exit code 2 for no secrets found) rather than suppressing all failures.

Suggested change

	--output filesystem-secrets.json || true
	echo "Filesystem scan completed"
	--output filesystem-secrets.json
	status=$?
	if [ $status -eq 0 ] || [ $status -eq 2 ]; then
	echo "Filesystem scan completed (exit code: $status)"
	else
	echo "Filesystem scan failed with exit code $status"
	exit $status
	fi

[Copilot]

[nitpick] This condition restricts OWASP ZAP scans to only the main branch, which may miss security issues in feature branches. Consider allowing scans on pull requests to catch security issues earlier in the development process.

Suggested change

	# Only run on main branch and non-dependabot
	if: github.ref == 'refs/heads/main' && github.actor != 'dependabot[bot]'
	# Run on push to main or pull request to main, and non-dependabot
	if: (github.ref == 'refs/heads/main' || github.event_name == 'pull_request') && github.actor != 'dependabot[bot]'

[Copilot]

The fallback object is duplicated and identical to the default parameter in Storage.get(). This creates unnecessary redundancy. Since Storage.get() already has a default, the || {...} fallback is redundant unless Storage.get() can return null/undefined despite having a default.