AI-Powered
Security Auditor
for Every PR

name: Security Scan (Strict)
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taoufikmohamed/securityauditor@v2
        with:
          repo-path: '.'
          mode: 'scan'
          output-path: 'security-report.json'
          fail-on-findings: 'true'  # ← blocks CI

      - name: Upload report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: security-reports
          path: security-report.json

name: Security Scan & Auto-Fix
on: [push, pull_request]

jobs:
  scan-and-fix:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: taoufikmohamed/securityauditor@v2
        with:
          mode: 'fix'
          apply-safe-fixes: 'true'  # ← AI auto-applies
        env:
          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}

      - name: Create PR with fixes
        uses: peter-evans/create-pull-request@v5
        with:
          title: '[Security] Automated fixes'
          branch: 'security/automated-fixes'

name: Security Scan (PR Comment)
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: taoufikmohamed/securityauditor@v2
        with:
          mode: 'scan'
          output-path: '${{ github.workspace }}/report.json'

      - name: Comment findings on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const r = JSON.parse(
              fs.readFileSync('report.json','utf8'));
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `🔒 Security: ${r.summary.total} findings`
            });