CI/CD Pipeline Integration

name: Scrutora PR Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  compliance-scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    env:
      SECUREHEALTH_API_URL: https://api.scrutora.com
      FRAMEWORKS: hipaa
      FAIL_THRESHOLD: high
      POLL_TIMEOUT: 600
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Create archive
        run: zip -r codebase.zip . -x '.git/*' 'node_modules/*' 'venv/*' '__pycache__/*' '.next/*' 'dist/*' 'build/*'

      - name: Upload and scan
        id: scan
        run: |
          PARAMS="frameworks=$FRAMEWORKS&scan_mode=auto&commit_sha=${{ github.sha }}&branch=${{ github.head_ref }}"
          PARAMS="$PARAMS&pr_number=${{ github.event.pull_request.number }}&base_branch=${{ github.base_ref }}"

          RESPONSE=$(curl -s -X POST \
            -H "Authorization: Bearer ${{ secrets.SECUREHEALTH_API_KEY }}" \
            -F "code=@codebase.zip" \
            "$SECUREHEALTH_API_URL/api/v1/scans?$PARAMS")

          SCAN_ID=$(echo "$RESPONSE" | jq -r '.scan_id')
          echo "scan_id=$SCAN_ID" >> "$GITHUB_OUTPUT"
          echo "Scan started: $SCAN_ID"

      - name: Wait for completion
        id: result
        run: |
          SCAN_ID=${{ steps.scan.outputs.scan_id }}
          TIMEOUT=$POLL_TIMEOUT
          ELAPSED=0
          while [ $ELAPSED -lt $TIMEOUT ]; do
            DETAILS=$(curl -s \
              -H "Authorization: Bearer ${{ secrets.SECUREHEALTH_API_KEY }}" \
              "$SECUREHEALTH_API_URL/api/v1/scans/$SCAN_ID/details?fail_threshold=$FAIL_THRESHOLD")

            STATUS=$(echo "$DETAILS" | jq -r '.status')
            if [ "$STATUS" = "completed" ] || [ "$STATUS" = "failed" ]; then
              echo "details=$DETAILS" >> "$GITHUB_OUTPUT"
              echo "$DETAILS" | jq .
              break
            fi
            echo "Scanning... ($STATUS) — ${ELAPSED}s elapsed"
            sleep 15
            ELAPSED=$((ELAPSED + 15))
          done

      - name: Comment on PR
        uses: actions/github-script@v7
        with:
          script: |
            const details = JSON.parse('${{ steps.result.outputs.details }}');
            const mode = details.scan_mode === 'incremental' ? 'Incremental' : 'Full';
            const status = details.check_status === 'pass' ? '✅ Pass' :
                           details.check_status === 'fail' ? '❌ Fail' : '⚠️ Warning';

            let body = `## Scrutora Compliance Scan\n\n`;
            body += `| Metric | Value |\n|---|---|\n`;
            body += `| Score | ${details.score ?? 'N/A'} |\n`;
            body += `| Violations | ${details.violations_count ?? 0} |\n`;
            body += `| Scan Mode | ${mode} |\n`;
            body += `| Status | ${status} |\n`;

            if (details.new_findings_count > 0) {
              body += `\n### New Findings (${details.new_findings_count})\n`;
              for (const f of details.new_findings || []) {
                body += `- **${f.severity.toUpperCase()}** \`${f.rule_id}\` ${f.file}:${f.line} — ${f.message}\n`;
              }
            }
            if (details.resolved_findings_count > 0) {
              body += `\n### Resolved (${details.resolved_findings_count}) 🎉\n`;
            }

            body += `\n[View Full Report](${details.report_url})\n`;
            body += `---\n`;
            body += `Scanned by [Scrutora](https://scrutora.com) | Commit: ${context.sha.substring(0, 7)}`;

            // Update existing comment or create new one
            const comments = await github.rest.issues.listComments({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
            });
            const existing = comments.data.find(c => c.body?.includes('Scrutora Compliance Scan'));
            if (existing) {
              await github.rest.issues.updateComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                body,
              });
            }

      - name: Check result
        run: |
          CHECK=$(echo '${{ steps.result.outputs.details }}' | jq -r '.check_status')
          if [ "$CHECK" = "fail" ]; then
            echo "::error::Compliance check failed"
            exit 1
          fi

# Compliance frameworks to scan
frameworks:
  - hipaa
  - gdpr

# Scan mode for PR builds (full or incremental)
pr_scan_mode: incremental

# Scan mode for pushes to main (full or incremental)
merge_scan_mode: full

# Severity threshold for PR failure (critical, high, medium, low, none)
fail_threshold: high

# Only fail on findings from these frameworks
required_frameworks:
  - hipaa

# ── Per-rule overrides ──────────────────────────────
rules:
  # Disable a rule entirely
  CONSENT-001:
    enabled: false

  # Override severity (critical, high, medium, low)
  TRANSFER-001:
    severity: low

  # Set minimum confidence threshold (violations below are dropped)
  RETENTION-001:
    min_confidence: 0.60

  # Combined overrides
  PII-001:
    severity: medium
    min_confidence: 0.70

# ── Global settings ─────────────────────────────────
settings:
  # Minimum confidence for any violation to be reported (0.0–1.0)
  min_confidence: 0.40

  # Glob patterns to exclude from scanning
  exclude_paths:
    - "tests/**"
    - "docs/**"
    - "migrations/**"
    - "src/generated/**"
    - "vendor/**"

# Suppress a rule everywhere
rule:CONSENT-001

# Suppress all violations in a specific file
file:src/generated/models.py

# Suppress a rule only in a specific file
rule:PII-001  file:app/legacy_service.py

# Suppress a specific line
rule:SDLC-001  file:config.py  line:42

# Glob patterns work for file matching
file:vendor/**
file:*.generated.cs

# Post scan results to an existing PR
curl -X POST "https://api.scrutora.com/api/github/pr/comment" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "scan_id": "abc123",
    "repo_full_name": "your-org/your-repo",
    "pr_number": 42
  }'

# Download SARIF results after a scan completes
curl -OJ "https://api.scrutora.com/api/v1/scans/{scan_id}/sarif" \
  -H "Authorization: Bearer sk_live_..."

# Upload to GitHub Code Scanning (in GitHub Actions)
- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif