# .github/workflows/shieldome-scan.yml
name: Shieldome Security Scan
on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
env:
  SHIELDOME_HOST: https://shieldome.com
  TARGET_URL: ${{ secrets.SHIELDOME_TARGET }}
  FAIL_ON: high
jobs:
  security-scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - name: Start scan
        id: scan
        run: |
          RESPONSE=$(curl -sf -X POST "$SHIELDOME_HOST/api/v1/scan" \
            -H "Content-Type: application/json" \
            -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            -d "{\"target\":\"$TARGET_URL\",\"scan_type\":\"vuln\"}")
          SCAN_ID=$(echo "$RESPONSE" | jq -r '.scan_id')
          echo "scan_id=$SCAN_ID" >> $GITHUB_OUTPUT
      - name: Wait for completion
        run: |
          for i in $(seq 1 90); do
            DATA=$(curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
              "$SHIELDOME_HOST/api/v1/scan/${{ steps.scan.outputs.scan_id }}")
            STATUS=$(echo "$DATA" | jq -r '.status')
            echo "[$i/90] $STATUS"
            [ "$STATUS" = "completed" ] && break
            [ "$STATUS" = "failed" ] && exit 1
            sleep 10
          done
      - name: Security gate
        run: |
          GATE=$(curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            "$SHIELDOME_HOST/api/v1/scan/${{ steps.scan.outputs.scan_id }}/gate?fail_on=$FAIL_ON")
          echo "$GATE" | jq .
          [ "$(echo "$GATE" | jq -r '.passed')" = "true" ] || exit 1

# .gitlab-ci.yml
include:
  - remote: 'https://shieldome.com/ci/gitlab-ci.yml'

# CI/CD Variables to set in Settings → CI/CD → Variables:
#   SHIELDOME_API_KEY  (masked)  - your Shieldome API key
#   SHIELDOME_TARGET             - target URL, e.g. https://example.com
#   SHIELDOME_FAIL_ON            - critical | high | medium | low | never (default: high)

export SHIELDOME_API_KEY=shd_your_key_here
export SHIELDOME_TARGET=https://example.com
export SHIELDOME_FAIL_ON=high      # critical | high | medium | low | never

# Download and run the scanner script
curl -sf https://shieldome.com/ci/shieldome-scan.sh | bash

# Or clone and run locally:
# bash ci/shieldome-scan.sh --target https://example.com --key shd_xxx --fail-on high

# bitbucket-pipelines.yml
image: alpine:3.19

pipelines:
  default:
    - step:
        name: Shieldome Security Scan
        script:
          - apk add --no-cache curl jq bash
          - export SHIELDOME_FAIL_ON=high
          - curl -sf https://shieldome.com/ci/shieldome-scan.sh | bash
        artifacts:
          - shieldome-report.pdf
          - shieldome-results.sarif

# Repository variables to set:
#   SHIELDOME_API_KEY  (secured)
#   SHIELDOME_TARGET