name: CybeDefend Security Scan

on:
  push:
    branches:
      - main
      - master
      - 'feat/**'
  pull_request:
    branches:
      - main
      - master

jobs:
  cybedefend_scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Run CybeDefend Security Scan
        env:
          CYBEDEFEND_PAT: ${{ secrets.CYBEDEFEND_PAT }}
          CYBEDEFEND_PROJECT_ID: ${{ secrets.CYBEDEFEND_PROJECT_ID }}
        run: |
          docker run --rm \
            -v "${{ gitea.workspace }}":/src -w /src \
            -e CYBEDEFEND_PAT="$CYBEDEFEND_PAT" \
            -e CYBEDEFEND_PROJECT_ID="$CYBEDEFEND_PROJECT_ID" \
            ghcr.io/cybedefend/cybedefend-cli:latest \
            scan --dir . --region eu --ci --break-on-severity critical

      - name: Fetch detailed SARIF results
        if: always()
        env:
          CYBEDEFEND_PAT: ${{ secrets.CYBEDEFEND_PAT }}
          CYBEDEFEND_PROJECT_ID: ${{ secrets.CYBEDEFEND_PROJECT_ID }}
        run: |
          docker run --rm \
            -v "${{ gitea.workspace }}":/src -w /src \
            -e CYBEDEFEND_PAT="$CYBEDEFEND_PAT" \
            -e CYBEDEFEND_PROJECT_ID="$CYBEDEFEND_PROJECT_ID" \
            ghcr.io/cybedefend/cybedefend-cli:latest \
            results --project-id "$CYBEDEFEND_PROJECT_ID" --all --output sarif --filename results.sarif --ci

      - name: Upload scan results as artifact
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: cybedefend-results
          path: results.sarif