plugin-security-scan.yml

name: Plugin Security Scan

on:
  pull_request:
    paths:
      - 'plugins/**/*.json'
  push:
    paths:
      - 'plugins/**/*.json'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Run security scan on changed manifests
        id: scan
        run: |
          node scripts/scan-plugin.js ${{ github.event.pull_request.number || '' }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Comment on PR with results
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            let scanResults = [];
            try {
              scanResults = JSON.parse(fs.readFileSync('/tmp/scan-results.json', 'utf8'));
            } catch (e) {
              console.log('No scan results file found');
              return;
            }

            for (const result of scanResults) {
              let comment = `## 🔍 Security Scan: ${result.plugin}\n\n`;

              if (result.status === 'safe') {
                comment += '✅ **Status**: Clean - No issues detected\n\n';
                comment += 'This plugin has passed automated security checks.';
              } else if (result.status === 'warning') {
                comment += '⚠️ **Status**: Warnings detected\n\n';
                comment += '**Issues found:**\n';
                result.issues.forEach(issue => {
                  comment += `- ${issue}\n`;
                });
                comment += '\n📋 This requires manual review before merging.';
              } else {
                comment += '🚨 **Status**: Suspicious patterns detected\n\n';
                comment += '**Critical issues:**\n';
                result.issues.forEach(issue => {
                  comment += `- ${issue}\n`;
                });
                comment += '\n❌ This plugin cannot be merged without thorough manual review.';
              }

              await github.rest.issues.createComment({
                issue_number: context.issue.number,
                owner: context.repo.owner,
                repo: context.repo.repo,
                body: comment
              });
            }