GitHub Actions

name: Shieldome Security Scan

on:
  push:
    branches: [ main, master ]
  pull_request:
    branches: [ main, master ]
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC
  workflow_dispatch:

permissions:
  security-events: write
  contents: read

env:
  SHIELDOME_HOST: https://app.shieldome.com
  TARGET_URL:     ${{ secrets.SHIELDOME_TARGET }}  # or hard-code: https://your-app.com
  FAIL_ON:        high  # critical | high | medium | low | never

jobs:
  security-scan:
    name: Shieldome Security Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Start scan
        id: scan
        run: |
          RESPONSE=$(curl -sf --retry 3 -X POST "$SHIELDOME_HOST/api/v1/scan" \
            -H "Content-Type: application/json" \
            -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            -d '{"target":"'"$TARGET_URL"'","scan_type":"vuln"}')
          echo "$RESPONSE"
          SCAN_ID=$(echo "$RESPONSE" | jq -r '.scan_id // empty')
          if [ -z "$SCAN_ID" ]; then
            echo "::error::Failed to start scan. Check SHIELDOME_API_KEY and TARGET_URL."
            exit 1
          fi
          echo "scan_id=$SCAN_ID" >> $GITHUB_OUTPUT
          echo "Scan started: $SCAN_ID"

      - name: Wait for completion (max 15 min)
        run: |
          SCAN_ID="${{ steps.scan.outputs.scan_id }}"
          for i in $(seq 1 90); do
            DATA=$(curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
              "$SHIELDOME_HOST/api/v1/scan/$SCAN_ID")
            STATUS=$(echo "$DATA" | jq -r '.status')
            PCT=$(echo "$DATA"    | jq -r '.progress.percent // "-"')
            echo "[$i/90] status=$STATUS  progress=${PCT}%"
            if [ "$STATUS" = "completed" ]; then break; fi
            if [ "$STATUS" = "failed" ] || [ "$STATUS" = "aborted" ]; then
              echo "::error::Scan ended with status '$STATUS'"
              exit 1
            fi
            sleep 10
          done

      - name: Security gate
        id: gate
        run: |
          GATE=$(curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            "$SHIELDOME_HOST/api/v1/scan/${{ steps.scan.outputs.scan_id }}/gate?fail_on=$FAIL_ON")
          echo "$GATE" | jq .

          PASSED=$(echo "$GATE" | jq -r '.passed')
          GRADE=$(echo "$GATE"  | jq -r '.grade')
          SCORE=$(echo "$GATE"  | jq -r '.risk_score')

          {
            echo "## 🛡 Shieldome Security Scan"
            echo ""
            echo "| | |"
            echo "|---|---|"
            echo "| **Target** | $TARGET_URL |"
            echo "| **Grade** | $GRADE |"
            echo "| **Risk Score** | $SCORE / 100 |"
            echo "| **Gate** | $FAIL_ON+ → $([ \"$PASSED\" = \"true\" ] && echo \"✅ PASSED\" || echo \"❌ FAILED\") |"
            echo ""
            echo "| Severity | Count |"
            echo "|---|---|"
            echo "$GATE" | jq -r '.counts | to_entries[] | "| \(.key) | \(.value) |"'
          } >> $GITHUB_STEP_SUMMARY

          if [ "$PASSED" != "true" ]; then
            echo "::error::Security gate FAILED - $FAIL_ON+ findings detected."
            exit 1
          fi

      - name: Download SARIF
        if: always()
        run: |
          curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            "$SHIELDOME_HOST/api/v1/scan/${{ steps.scan.outputs.scan_id }}/sarif" \
            -o shieldome-results.sarif || true

      - name: Upload SARIF to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: shieldome-results.sarif
          category:    shieldome
        continue-on-error: true

      - name: Download PDF report
        if: always()
        run: |
          curl -sf -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
            "$SHIELDOME_HOST/api/scan/${{ steps.scan.outputs.scan_id }}/report" \
            -o shieldome-report.pdf || true

      - name: Upload artifacts
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name:            shieldome-security-report
          path:            |
            shieldome-report.pdf
            shieldome-results.sarif
          retention-days: 30

- name: Comment on PR
  if: github.event_name == 'pull_request' && always()
  uses: actions/github-script@v7
  with:
    script: |
      const gate = JSON.parse(process.env.GATE_JSON || '{}');
      const icon = gate.passed ? '✅' : '❌';
      github.rest.issues.createComment({
        owner: context.repo.owner,
        repo:  context.repo.repo,
        issue_number: context.issue.number,
        body: [
          `## ${icon} Shieldome Security Scan`,
          `| Severity | Count |`,
          `|---|---|`,
          `| 🔴 Critical | ${gate.counts?.critical ?? 0} |`,
          `| 🟠 High     | ${gate.counts?.high ?? 0} |`,
          `| 🟡 Medium   | ${gate.counts?.medium ?? 0} |`,
          `| 🔵 Low      | ${gate.counts?.low ?? 0} |`,
          ``,
          `**Risk Score:** ${gate.risk_score ?? '-'}/100 · **Grade:** ${gate.grade ?? '-'}`,
          `[View full report](https://app.shieldome.com)`,
        ].join('\n')
      })

- name: Start authenticated scan
  run: |
    curl -sf -X POST "$SHIELDOME_HOST/api/v1/scan" \
      -H "Content-Type: application/json" \
      -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_API_KEY }}" \
      -d '{
        "target":    "${{ secrets.SHIELDOME_TARGET }}",
        "scan_type": "vuln",
        "cookie":    "${{ secrets.SCAN_SESSION_COOKIE }}"
      }'