name: SecurePR Security Scan

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger SecurePR Scan
        run: |
          RESPONSE=$(curl -s -X POST https://api.securepr.dev/api/scan \
            -H "Content-Type: application/json" \
            -H "X-API-Key: ${{ secrets.SECUREPR_API_KEY }}" \
            -d "{\"repo_url\": \"https://github.com/${{ github.repository }}\", \"pr_number\": ${{ github.event.pull_request.number }}, \"branch\": \"${{ github.head_ref }}\"}")
          
          JOB_ID=$(echo $RESPONSE | python3 -c "import sys,json; print(json.load(sys.stdin).get('job_id',''))")
          echo "Job ID: $JOB_ID"
          
          for i in $(seq 1 20); do
            sleep 10
            RESULT=$(curl -s https://api.securepr.dev/api/scan/$JOB_ID \
              -H "X-API-Key: ${{ secrets.SECUREPR_API_KEY }}")
            STATUS=$(echo $RESULT | python3 -c "import sys,json; print(json.load(sys.stdin).get('status',''))")
            echo "Status: $STATUS"
            if [ "$STATUS" = "complete" ] || [ "$STATUS" = "error" ]; then
              echo "Result: $RESULT"
              break
            fi
          done
