GitHub Actions Integration

name: Security Scan
 
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
 
jobs:
  alprina-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
 
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'
 
      - name: Install Alprina
        run: pip install alprina-cli
 
      - name: Run security scan
        run: alprina scan ./src --output results.json --fail-on high
        env:
          ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}
 
      - name: Upload results
        if: always()
        uses: actions/upload-artifact@v3
        with:
          name: alprina-results
          path: results.json

git add .github/workflows/security-scan.yml
git commit -m "Add Alprina security scanning"
git push

name: Security Scan
on:
  push:
    branches: [main]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: pip install alprina-cli
      - run: alprina scan ./src
        env:
          ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}

- name: Security scan with failure threshold
  run: alprina scan ./src --fail-on high
  env:
    ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}

- name: Get changed files
  id: changed-files
  uses: tj-actions/changed-files@v39
 
- name: Scan changed files
  if: steps.changed-files.outputs.all_changed_files != ''
  run: |
    for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
      alprina scan "$file" || true
    done
  env:
    ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}

strategy:
  matrix:
    target:
      - path: './frontend'
        language: 'javascript'
      - path: './backend'
        language: 'python'
      - path: './api'
        language: 'go'
steps:
  - uses: actions/checkout@v3
  - run: pip install alprina-cli
  - name: Scan ${{ matrix.target.path }}
    run: alprina scan ${{ matrix.target.path }} --language ${{ matrix.target.language }}
    env:
      ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}

on:
  schedule:
    - cron: '0 0 * * 0'  # Every Sunday at midnight
jobs:
  comprehensive-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - run: pip install alprina-cli
      - run: alprina scan ./src --profile comprehensive --output weekly-scan.json
        env:
          ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}
      - uses: actions/upload-artifact@v3
        with:
          name: weekly-scan
          path: weekly-scan.json
          retention-days: 90

- name: Cache pip packages
  uses: actions/cache@v3
  with:
    path: ~/.cache/pip
    key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
    restore-keys: |
      ${{ runner.os }}-pip-
 
- name: Install Alprina
  run: pip install alprina-cli

- name: Run scan
  id: scan
  run: alprina scan ./src --output results.json
  continue-on-error: true
  env:
    ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}
 
- name: Comment PR
  uses: actions/github-script@v6
  if: github.event_name == 'pull_request'
  with:
    script: |
      const fs = require('fs');
      const results = JSON.parse(fs.readFileSync('results.json', 'utf8'));
      const comment = `
      ## Alprina Security Scan Results
 
      **Findings:** ${results.summary.total_findings}
      - Critical: ${results.summary.critical || 0}
      - High: ${results.summary.high || 0}
      - Medium: ${results.summary.medium || 0}
      - Low: ${results.summary.low || 0}
      `;
 
      github.rest.issues.createComment({
        issue_number: context.issue.number,
        owner: context.repo.owner,
        repo: context.repo.repo,
        body: comment
      });

- name: Run scan
  run: alprina scan ./src --output report.html
  env:
    ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}
 
- name: Deploy report to GitHub Pages
  uses: peaceiris/actions-gh-pages@v3
  with:
    github_token: ${{ secrets.GITHUB_TOKEN }}
    publish_dir: ./
    keep_files: true

- name: Check if security-sensitive files changed
  id: security-check
  run: |
    if git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -E '(auth|security|crypto)'; then
      echo "security_changed=true" >> $GITHUB_OUTPUT
    fi
 
- name: Run security scan
  if: steps.security-check.outputs.security_changed == 'true'
  run: alprina scan ./src --fail-on medium
  env:
    ALPRINA_API_KEY: ${{ secrets.ALPRINA_API_KEY }}

jobs:
  security-scan:  # This name appears in branch protection
    runs-on: ubuntu-latest
    steps:
      # ... scan steps

jobs:
  scan:
    timeout-minutes: 30  # Add timeout