開発者向けリファレンスガイド: 監査の実行と管理

name: Cyfendo PR Security Gate

on:
  pull_request:
    branches: [main, master]
    types: [opened, synchronize, reopened]

# Cancel in-progress runs when new commits are pushed to the same pull request
concurrency:
  group: cyfendo-${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  security-gate:
    name: Cyfendo Private Security Gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # Required to publish SARIF alerts to GitHub PR Files Changed tab
      actions: read  # Required for upload-sarif to query workflow run metadata

    steps:
      - name: Checkout Pull Request Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Cyfendo CLI & Model Provider SDK
        run: |
          pip install --upgrade cyfendo google-genai
          # For OpenAI:    pip install --upgrade cyfendo openai
          # For Anthropic: pip install --upgrade cyfendo anthropic

      - name: Run Cyfendo Private Scan
        env:
          CYFENDO_API_KEY: ${{ secrets.CYFENDO_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
          # OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
          # ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: >
          cyfendo scan .
          --private
          --provider gemini
          --fail-on high
          --generate-patch
          --sarif cyfendo-results.sarif
          --no-interactive

      # Publish standard SARIF 2.1.0 findings to PR "Files changed" annotations
      - name: Upload SARIF to GitHub PR & Security Tab
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('cyfendo-results.sarif') != ''  # Upload whenever SARIF exists (even if quality gate fails)
        continue-on-error: true  # Resilient if GitHub Advanced Security is disabled on private repos
        with:
          sarif_file: cyfendo-results.sarif

      # Archive generated remediation patches so developers can download & apply them
      - name: Archive Remediation Patches & SARIF
        uses: actions/upload-artifact@v4
        if: always()
        continue-on-error: true
        with:
          name: cyfendo-remediation-patches
          include-hidden-files: true  # .cyfendo/ is a hidden folder, which upload-artifact skips by default
          path: |
            cyfendo-results.sarif
            .cyfendo/patches/
            .cyfendo/report.md

      # Publish quick audit summary directly into the GitHub Actions run summary
      - name: Publish PR Step Summary
        if: always()
        run: |
          if [ -f .cyfendo/report.md ]; then
            echo "## Cyfendo Security Gate Summary" >> $GITHUB_STEP_SUMMARY
            cat .cyfendo/report.md >> $GITHUB_STEP_SUMMARY
          fi

name: Cyfendo Cloud PR Security Gate

on:
  pull_request:
    branches: [main, master]
    types: [opened, synchronize, reopened]

concurrency:
  group: cyfendo-cloud-${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  security-gate:
    name: Cyfendo Server Security Gate
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write  # Required to publish SARIF alerts to GitHub PR Files Changed tab
      actions: read  # Required for upload-sarif to query workflow run metadata

    steps:
      - name: Checkout Pull Request Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # Install Cyfendo CLI (no model provider SDKs needed for server scans)
      - name: Install Cyfendo CLI
        run: pip install --upgrade cyfendo

      # Run scan on Cyfendo server with automated AI patch synthesis (no --private flag)
      - name: Run Cyfendo Server PR Scan & Patch Generation
        env:
          CYFENDO_API_KEY: ${{ secrets.CYFENDO_API_KEY }}
          # Optional: set custom endpoint if using self-hosted Cyfendo server
          # CYFENDO_SERVER_URL: ${{ vars.CYFENDO_SERVER_URL }}
        run: >
          cyfendo scan .
          --fail-on high
          --generate-patch
          --sarif cyfendo-results.sarif
          --no-interactive
          --yes

      # Publish standard SARIF 2.1.0 findings to PR "Files changed" annotations
      - name: Upload SARIF to GitHub PR & Security Tab
        uses: github/codeql-action/upload-sarif@v4
        if: always() && hashFiles('cyfendo-results.sarif') != ''  # Upload whenever SARIF exists
        continue-on-error: true  # Resilient if GitHub Advanced Security is disabled on private repos
        with:
          sarif_file: cyfendo-results.sarif

      # Archive generated remediation patches and audit reports
      - name: Archive Remediation Patches & SARIF
        uses: actions/upload-artifact@v4
        if: always()
        continue-on-error: true
        with:
          name: cyfendo-remediation-patches
          include-hidden-files: true  # .cyfendo/ is a hidden folder, which upload-artifact skips by default
          path: |
            cyfendo-results.sarif
            .cyfendo/patches/
            .cyfendo/report.md

      # Publish quick audit summary directly into the GitHub Actions run summary
      - name: Publish PR Step Summary
        if: always()
        run: |
          if [ -f .cyfendo/report.md ]; then
            echo "## Cyfendo Security Gate Summary" >> $GITHUB_STEP_SUMMARY
            cat .cyfendo/report.md >> $GITHUB_STEP_SUMMARY
          fi

# 1. Monorepo scoping: Trigger only when files in the service directory change
on:
  pull_request:
    paths:
      - 'services/auth-api/**'
      - 'packages/shared-security/**'

jobs:
  fast-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Install Cyfendo CLI
        run: pip install --upgrade cyfendo

      # 2. Scope the scan target to only the modified microservice
      - name: Fast Monorepo PR Scan
        env:
          CYFENDO_API_KEY: ${{ secrets.CYFENDO_API_KEY }}
          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
        run: >
          cyfendo scan ./services/auth-api
          --private
          --provider gemini
          --fail-on high
          --sarif cyfendo-results.sarif
          --no-interactive

stages:
  - security

cyfendo-private-gate:
  stage: security
  image: python:3.11-slim
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
  variables:
    CYFENDO_API_KEY: "$CYFENDO_API_KEY"
    GEMINI_API_KEY: "$GEMINI_API_KEY"
  before_script:
    - pip install --no-cache-dir cyfendo google-genai
  script:
    - >
      cyfendo scan .
      --private
      --provider gemini
      --fail-on high
      --sarif cyfendo-results.sarif
      --no-interactive
  artifacts:
    when: always
    reports:
      sast: cyfendo-results.sarif
    paths:
      - cyfendo-results.sarif
      - .cyfendo/report.md