CI/CD Integrations

# .github/workflows/security-scan.yml
name: SecureAI Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run nightly security scans at 2 AM UTC
    - cron: '0 2 * * *'

jobs:
  security-scan:
    name: AI Security Analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        fetch-depth: 0  # Full history for better analysis
    
    - name: Setup SecureAI Scanner
      uses: secureai/setup-action@v1
      with:
        api-key: ${{ secrets.SECUREAI_API_KEY }}
        version: 'latest'
    
    - name: Run Security Scan
      id: scan
      run: |
        secureai scan . \
          --format json \
          --output results.json \
          --severity-threshold medium \
          --include-fixes \
          --agents asi,llm
    
    - name: Upload to GitHub Security
      if: always()
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: results.sarif
    
    - name: Comment on PR
      if: github.event_name == 'pull_request'
      uses: secureai/pr-comment-action@v1
      with:
        results-file: results.json
        github-token: ${{ secrets.GITHUB_TOKEN }}
    
    - name: Fail on Critical Issues
      if: steps.scan.outputs.critical_count > 0
      run: |
        echo "❌ Critical security issues found!"
        echo "Critical vulnerabilities: ${{ steps.scan.outputs.critical_count }}"
        exit 1

# Advanced workflow with matrix strategy
---
name: Multi-Language Security Scan

on: [push, pull_request]

jobs:
  security-matrix:
    strategy:
      matrix:
        language: [python, javascript, typescript]
        include:
          - language: python
            path: "**/*.py"
            agents: "asi,llm"
          - language: javascript
            path: "**/*.js"
            agents: "asi01,asi02,asi06,llm01"
          - language: typescript
            path: "**/*.ts"
            agents: "asi,llm"
    
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    
    - name: Scan ${{ matrix.language }} files
      run: |
        secureai scan \
          --include-path "${{ matrix.path }}" \
          --language ${{ matrix.language }} \
          --agents ${{ matrix.agents }} \
          --output ${{ matrix.language }}-results.json