CI/CD Integration

name: Security Scan

on: [push, pull_request]

jobs:
  patcha:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          
      - name: Install dependencies
        run: npm ci
        
      - name: Scan vulnerabilities
        run: npx patcha scan

name: Auto-fix Vulnerabilities

on:
  schedule:
    - cron: '0 0 * * *'  # Daily at midnight
  workflow_dispatch:

jobs:
  patcha-fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          
      - name: Install dependencies
        run: npm ci
        
      - name: Fix vulnerabilities
        run: npx patcha fix --auto
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

- name: Fix and create MR
  run: npx patcha fix --auto --mr
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

stages:
  - security

patcha:
  stage: security
  image: node:20
  script:
    - npm ci
    - npx patcha scan
  only:
    - main
    - merge_requests

workflows:
  version: 2
  security:
    jobs:
      - patcha-scan:
          context:
            - patcha-api

patcha scan --level critical || exit 1

patcha scan --json > vulnerability-report-${{ github.run_id }}.json

on:
  schedule:
    - cron: '0 0 * * *'

# Exit with code 1 if vulnerabilities found, but continue
patcha scan || true