grok-cli/.github/workflows/pr-commit-security-scan.yml

name: PR Commit Security Scan

on:
  pull_request_target:
    types: [opened, reopened, synchronize, ready_for_review]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  scan:
    name: Scan PR commits
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    concurrency:
      group: brin-pr-${{ github.event.pull_request.number }}
      cancel-in-progress: true

    steps:
      - name: Scan commits with Brin
        id: scan
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
          REPO: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          BLOCK_BELOW: "30"
        run: |
          set -euo pipefail

          total=0
          blocking=0
          review=0
          inconclusive=0
          rows=""

          while IFS=$'\t' read -r sha title; do
            total=$((total + 1))
            short_sha="${sha:0:7}"
            commit_url="https://github.com/${REPO}/commit/${sha}"

            response="$(
              curl -sfL --max-time 300 \
                "https://api.brin.sh/commit/${REPO}@${sha}?details=true&mode=full&tolerance=conservative" \
                || echo '{}'
            )"

            pending="$(jq -r '.pending_deep_scan // false' <<<"$response")"
            score="$(jq -r '.score // empty' <<<"$response")"
            verdict="$(jq -r '.verdict // "unknown"' <<<"$response")"

            if [ -z "$score" ] || [ "$pending" = "true" ]; then
              inconclusive=$((inconclusive + 1))
              rows="${rows}| [\`${short_sha}\`](${commit_url}) | inconclusive | unknown | follow up | Scan did not complete in time |\n"
              continue
            fi

            detail="$(
              jq -r '(.threats // []) | map("\(.type): \(.detail)") | .[0] // "No threat detail provided"' \
                <<<"$response"
            )"
            detail="${detail//$'\n'/ }"

            if [ "$verdict" = "dangerous" ] || [ "$score" -lt "$BLOCK_BELOW" ]; then
              blocking=$((blocking + 1))
              rows="${rows}| [\`${short_sha}\`](${commit_url}) | ${score} | ${verdict} | block | ${detail} |\n"
            elif [ "$verdict" = "suspicious" ]; then
              review=$((review + 1))
              rows="${rows}| [\`${short_sha}\`](${commit_url}) | ${score} | ${verdict} | review | ${detail} |\n"
            fi
          done < <(
            gh api "repos/${REPO}/pulls/${PR_NUMBER}/commits?per_page=100" \
              --paginate \
              --jq '.[] | [.sha, (.commit.message | split("\n")[0])] | @tsv'
          )

          has_findings=false
          if [ "$blocking" -gt 0 ] || [ "$review" -gt 0 ] || [ "$inconclusive" -gt 0 ]; then
            has_findings=true
          fi

          overall="clean"
          if [ "$blocking" -gt 0 ]; then
            overall="blocking"
          elif [ "$review" -gt 0 ]; then
            overall="review"
          elif [ "$inconclusive" -gt 0 ]; then
            overall="inconclusive"
          fi

          {
            echo "total=${total}"
            echo "blocking=${blocking}"
            echo "review=${review}"
            echo "inconclusive=${inconclusive}"
            echo "has_findings=${has_findings}"
            echo "overall=${overall}"
            if [ "$blocking" -gt 0 ]; then
              echo "should_fail=true"
            else
              echo "should_fail=false"
            fi
          } >> "$GITHUB_OUTPUT"

          if [ "$has_findings" = "true" ]; then
            {
              echo "rows<<BRIN_EOF"
              printf "%b" "$rows"
              echo "BRIN_EOF"
            } >> "$GITHUB_OUTPUT"
          fi

          {
            echo "## Brin PR Commit Scan"
            echo
            echo "- Overall: ${overall}"
            echo "- Commits scanned: ${total}"
            echo "- Blocking findings: ${blocking}"
            echo "- Review findings: ${review}"
            echo "- Inconclusive scans: ${inconclusive}"
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Create or update PR comment
        if: steps.scan.outputs.has_findings == 'true'
        uses: actions/github-script@v7
        env:
          TOTAL: ${{ steps.scan.outputs.total }}
          BLOCKING: ${{ steps.scan.outputs.blocking }}
          REVIEW: ${{ steps.scan.outputs.review }}
          INCONCLUSIVE: ${{ steps.scan.outputs.inconclusive }}
          OVERALL: ${{ steps.scan.outputs.overall }}
          ROWS: ${{ steps.scan.outputs.rows }}
        with:
          script: |
            const marker = "<!-- brin-pr-commit-scan -->";

            let headline = "No issues found.";
            if (process.env.OVERALL === "blocking") {
              headline = "This PR contains commit-level findings that should block merge.";
            } else if (process.env.OVERALL === "review") {
              headline = "This PR contains commit-level findings that should be reviewed.";
            } else if (process.env.OVERALL === "inconclusive") {
              headline = "Some commit scans were inconclusive and may need a rerun.";
            }

            const body = [
              marker,
              "### Brin PR Commit Scan",
              "",
              headline,
              "",
              `- Commits scanned: ${process.env.TOTAL}`,
              `- Blocking findings: ${process.env.BLOCKING}`,
              `- Review findings: ${process.env.REVIEW}`,
              `- Inconclusive scans: ${process.env.INCONCLUSIVE}`,
              "",
              "| Commit | Score | Verdict | Action | Detail |",
              "|--------|-------|---------|--------|--------|",
              process.env.ROWS ?? "",
              "",
              "<sub>Scanned by [Brin](https://brin.sh)</sub>",
            ].join("\n");

            const { owner, repo } = context.repo;
            const issue_number = context.payload.pull_request.number;

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner,
              repo,
              issue_number,
              per_page: 100,
            });

            const existing = comments.find((c) => c.body?.includes(marker));

            if (existing) {
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: existing.id,
                body,
              });
            } else {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body,
              });
            }

      - name: Delete old comment when PR is clean
        if: steps.scan.outputs.has_findings == 'false'
        uses: actions/github-script@v7
        with:
          script: |
            const marker = "<!-- brin-pr-commit-scan -->";
            const { owner, repo } = context.repo;
            const issue_number = context.payload.pull_request.number;

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner,
              repo,
              issue_number,
              per_page: 100,
            });

            const existing = comments.find((c) => c.body?.includes(marker));

            if (existing) {
              await github.rest.issues.deleteComment({
                owner,
                repo,
                comment_id: existing.id,
              });
            }

      - name: Fail if blocking findings exist
        if: steps.scan.outputs.should_fail == 'true'
        run: |
          echo "::error::Brin found one or more dangerous commits or commits scoring below 30"
          exit 1