# Feature B (+C) — Security-Scan, HART blockierend, mit KI-Klartext-Erklärung.
# In ein Ziel-Repo kopieren nach: .gitea/workflows/security.yml
#
# Ablauf: scannen (ohne sofort abzubrechen) -> Gate (failt hart bei Funden) ->
# bei Fehler erklärt die KI die Funde im PR. So failt der Check verlässlich UND
# der Erklär-Schritt sieht beide Reports.
name: Security

on:
  pull_request:
  push:
    branches: [main, master]

jobs:
  scan:
    runs-on: eulernest
    container: ghcr.io/catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout (volle Historie für Gitleaks)
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Gitleaks (Secret-Scan)
        id: gitleaks
        continue-on-error: true
        run: |
          curl -sSL https://github.com/gitleaks/gitleaks/releases/latest/download/gitleaks_linux_x64.tar.gz \
            | tar -xz -C /usr/local/bin gitleaks
          gitleaks detect --source . --report-format json --report-path /tmp/gitleaks.json --no-banner \
            | tee /tmp/gitleaks.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"

      - name: Trivy (fs + IaC, HIGH/CRITICAL)
        id: trivy
        continue-on-error: true
        run: |
          curl -sSL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
            | sh -s -- -b /usr/local/bin
          trivy fs --scanners vuln,secret,misconfig --severity HIGH,CRITICAL \
            --exit-code 1 --no-progress . | tee /tmp/trivy.txt; echo "code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"

      - name: Gate — hart blockieren bei Funden
        run: |
          cat /tmp/gitleaks.txt /tmp/trivy.txt > /tmp/scan.log 2>/dev/null || true
          if [ "${{ steps.gitleaks.outputs.code }}" != "0" ] || [ "${{ steps.trivy.outputs.code }}" != "0" ]; then
            echo "Security-Funde — Check schlägt fehl (hart blockierend)."; exit 1
          fi
          echo "Keine HIGH/CRITICAL-Funde."

      - name: KI erklärt die Funde (nur bei Fehler)
        if: failure()
        env:
          AI_PROVIDER: anthropic
          AI_MODEL: claude-3-5-haiku-latest
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITEA_TOKEN: ${{ github.token }}
          GITEA_API: https://git.eulernest.eu/api/v1
        run: |
          git clone --depth 1 https://git.eulernest.eu/user2595/ci-ai.git /opt/ci-ai
          python3 /opt/ci-ai/scripts/ai_explain.py security /tmp/scan.log