CI/CD Integration

name: Sarix Security Scan

on:
  pull_request:
    branches: [main]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install Sarix
        run: pip install sarix

      - name: Run security scan
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: sarix scan src/ --task security -o sarif > sarix.sarif

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sarix.sarif

name: Sarix Diff Review

on:
  pull_request:
    branches: [main]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - run: pip install sarix

      - name: Review changed files
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
        run: sarix diff --task security -o sarif > sarix.sarif

      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: sarix.sarif

sarix-scan:
  image: python:3.12
  stage: test
  script:
    - pip install sarix
    - sarix scan src/ --task security -o json > report.json
  artifacts:
    reports:
      codequality: report.json
  variables:
    OPENAI_API_KEY: $OPENAI_API_KEY

repos:
  - repo: local
    hooks:
      - id: sarix-security
        name: Sarix Security Check
        entry: sarix diff --staged --task security
        language: system
        pass_filenames: false
        stages: [commit]

$ sarix security src/auth.py -o sarif > results.sarif