CI/CD Integration

name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    outputs:
      staging_url: ${{ steps.deploy.outputs.url }}
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        id: deploy
        run: echo "url=https://staging-${{ github.sha }}.myapp.io" >> $GITHUB_OUTPUT

  penetrify-scan:
    needs: deploy-staging
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - name: Run Penetrify security scan
        uses: penetrify/scan-action@v1
        with:
          url: ${{ needs.deploy-staging.outputs.staging_url }}
          api-key: ${{ secrets.PENETRIFY_API_KEY }}
          fail-on: critical,high
          report-format: sarif

      - name: Upload results to GitHub Security
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: penetrify-results.sarif

      - name: Upload HTML report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-report
          path: penetrify-report.html

stages:
  - build
  - deploy
  - security
  - release

deploy-staging:
  stage: deploy
  script:
    - ./scripts/deploy-staging.sh
  environment:
    name: staging
    url: https://staging.myapp.io

penetrify-scan:
  stage: security
  image: penetrify/cli:latest
  needs: [deploy-staging]
  variables:
    PENETRIFY_API_KEY: $PENETRIFY_API_KEY
    SCAN_URL: https://staging.myapp.io
  script:
    - penetrify scan $SCAN_URL
        --fail-on critical,high
        --report-format gl-dast
        --output gl-dast-report.json
  artifacts:
    when: always
    reports:
      dast: gl-dast-report.json
    paths: [gl-dast-report.json]
    expire_in: 30 days
  allow_failure: false

# Authenticate once — stores token in ~/.penetrify
penetrify auth login --api-key $PENETRIFY_API_KEY

# Run a full scan and fail on critical or high findings
penetrify scan https://staging.myapp.io \
  --fail-on critical,high \
  --report-format html \
  --output ./security-report.html

# Exit code 0 = no blocking findings → pipeline continues
# Exit code 1 = critical or high findings found → pipeline fails

version: 2.1

jobs:
  security-scan:
    docker:
      - image: cimg/node:20.0
    steps:
      - run:
          name: Install Penetrify CLI
          command: npm install -g @penetrify/cli
      - run:
          name: Run security scan
          command: |
            penetrify scan $STAGING_URL \
              --api-key $PENETRIFY_API_KEY \
              --fail-on critical,high \
              --report-format html \
              --output /tmp/security-report.html
      - store_artifacts:
          path: /tmp/security-report.html
          destination: security-report.html

pipeline {
  agent any
  stages {
    stage('Deploy Staging') { /* ... */ }
    stage('Security Scan') {
      steps {
        withCredentials([string(credentialsId: 'penetrify-api-key', variable: 'PENETRIFY_API_KEY')]) {
          sh '''
            npm install -g @penetrify/cli
            penetrify scan https://staging.myapp.io \
              --api-key $PENETRIFY_API_KEY \
              --fail-on critical,high \
              --report-format html \
              --output security-report.html
          '''
        }
      }
      post {
        always {
          archiveArtifacts artifacts: 'security-report.html'
        }
      }
    }
  }
}

image: node:20

pipelines:
  branches:
    main:
      - step:
          name: Deploy to staging
          script:
            - ./scripts/deploy.sh
      - step:
          name: Security scan
          script:
            - npm install -g @penetrify/cli
            - penetrify scan $STAGING_URL --api-key $PENETRIFY_API_KEY --fail-on critical,high
          artifacts:
            - penetrify-report.html

trigger:
  - main

pool:
  vmImage: ubuntu-latest

steps:
  - script: npm install -g @penetrify/cli
    displayName: Install Penetrify CLI

  - script: |
      penetrify scan $(STAGING_URL) \
        --api-key $(PENETRIFY_API_KEY) \
        --fail-on critical,high \
        --report-format html \
        --output $(Build.ArtifactStagingDirectory)/security-report.html
    displayName: Run security scan
    env:
      PENETRIFY_API_KEY: $(PENETRIFY_API_KEY)

  - task: PublishBuildArtifacts@1
    condition: always()
    inputs:
      PathtoPublish: $(Build.ArtifactStagingDirectory)
      ArtifactName: security-report

version: 0.2

phases:
  install:
    runtime-versions:
      nodejs: 20
    commands:
      - npm install -g @penetrify/cli
  build:
    commands:
      - penetrify scan $STAGING_URL --api-key $PENETRIFY_API_KEY --fail-on critical,high --report-format html --output security-report.html

artifacts:
  files:
    - security-report.html

{
  "scan": {
    "type": "full",
    "fail_on": ["critical", "high"],
    "timeout": 3600
  },
  "exclude": {
    "paths": ["/health", "/metrics", "/admin/setup"],
    "checks": ["clickjacking"]
  },
  "report": {
    "formats": ["html", "json"],
    "output_dir": "./security-reports"
  },
  "notifications": {
    "slack_webhook": "$SLACK_WEBHOOK_URL"
  }
}