🚀 CI/CD Integration - APILeak¶

# .github/workflows/api-security.yml
name: API Security Testing

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  api-security-scan:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'

    - name: Install dependencies
      run: |
        python -m pip install --upgrade pip
        pip install -r requirements.txt

    - name: Run APILeak Security Scan
      env:
        API_ENDPOINT: ${{ secrets.STAGING_API_URL }}
        JWT_TOKEN: ${{ secrets.API_JWT_TOKEN }}
      run: |
        python apileaks.py scan \
          --target "$API_ENDPOINT" \
          --jwt "$JWT_TOKEN" \
          --modules bola,auth,property,resource \
          --rate-limit 3 \
          --output "security-scan-${{ github.run_number }}" \
          --log-level ERROR

    - name: Upload Security Reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: security-reports
        path: reports/
        retention-days: 30

    - name: Comment PR with Results
      if: github.event_name == 'pull_request'
      uses: actions/github-script@v6
      with:
        script: |
          const fs = require('fs');
          const path = 'reports/security-scan-${{ github.run_number }}.json';

          if (fs.existsSync(path)) {
            const report = JSON.parse(fs.readFileSync(path, 'utf8'));
            const summary = report.summary;

            const comment = `## 🛡️ API Security Scan Results

            **Target:** ${report.target}
            **Scan ID:** ${report.scan_id}

            ### Findings Summary
            - **Critical:** ${summary.critical}
            - **High:** ${summary.high}
            - **Medium:** ${summary.medium}
            - **Low:** ${summary.low}
            - **Info:** ${summary.info}

            ${summary.critical > 0 ? '❌ **Critical vulnerabilities found! Review required.**' : 
              summary.high > 0 ? '⚠️ **High severity vulnerabilities found.**' : 
              '✅ **No critical vulnerabilities found.**'}

            Full reports available in workflow artifacts.`;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });
          }

# .github/workflows/api-security-advanced.yml
name: Advanced API Security Testing

on:
  workflow_dispatch:
    inputs:
      environment:
        description: 'Environment to test'
        required: true
        default: 'staging'
        type: choice
        options:
        - staging
        - production
      modules:
        description: 'OWASP modules to run'
        required: false
        default: 'bola,auth,property,resource'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    environment: ${{ github.event.inputs.environment }}

    strategy:
      matrix:
        scan-type: [endpoints, parameters, full-owasp]

    steps:
    - uses: actions/checkout@v4

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.9'

    - name: Install APILeak
      run: |
        pip install -r requirements.txt

    - name: Configure scan parameters
      id: config
      run: |
        case "${{ matrix.scan-type }}" in
          "endpoints")
            echo "command=dir" >> $GITHUB_OUTPUT
            echo "modules=" >> $GITHUB_OUTPUT
            ;;
          "parameters")
            echo "command=par" >> $GITHUB_OUTPUT
            echo "modules=" >> $GITHUB_OUTPUT
            ;;
          "full-owasp")
            echo "command=scan" >> $GITHUB_OUTPUT
            echo "modules=${{ github.event.inputs.modules }}" >> $GITHUB_OUTPUT
            ;;
        esac

    - name: Run Security Scan
      env:
        API_ENDPOINT: ${{ secrets[format('{0}_API_URL', github.event.inputs.environment)] }}
        JWT_TOKEN: ${{ secrets[format('{0}_JWT_TOKEN', github.event.inputs.environment)] }}
      run: |
        python apileaks.py ${{ steps.config.outputs.command }} \
          --target "$API_ENDPOINT" \
          --jwt "$JWT_TOKEN" \
          ${{ steps.config.outputs.modules && format('--modules {0}', steps.config.outputs.modules) || '' }} \
          --rate-limit 2 \
          --output "${{ matrix.scan-type }}-${{ github.event.inputs.environment }}-${{ github.run_number }}" \
          --log-level INFO

    - name: Upload Reports
      uses: actions/upload-artifact@v3
      if: always()
      with:
        name: ${{ matrix.scan-type }}-reports
        path: reports/

# .gitlab-ci.yml
stages:
  - security-test
  - deploy

variables:
  PYTHON_VERSION: "3.9"
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"

cache:
  paths:
    - .cache/pip/
    - venv/

api-security-scan:
  stage: security-test
  image: python:$PYTHON_VERSION

  before_script:
    - python -m venv venv
    - source venv/bin/activate
    - pip install --upgrade pip
    - pip install -r requirements.txt

  script:
    - |
      python apileaks.py scan \
        --target "$STAGING_API_URL" \
        --jwt "$API_JWT_TOKEN" \
        --modules bola,auth,property,resource \
        --rate-limit 3 \
        --output "security-scan-$CI_PIPELINE_ID" \
        --log-level ERROR

  artifacts:
    when: always
    paths:
      - reports/
    expire_in: 30 days
    reports:
      junit: reports/security-scan-*.xml  # If an XML report is generated

  only:
    - main
    - develop
    - merge_requests

# Pipeline for production with restrictions
production-security-scan:
  stage: security-test
  image: python:$PYTHON_VERSION

  before_script:
    - python -m venv venv
    - source venv/bin/activate
    - pip install -r requirements.txt

  script:
    - |
      # Very low rate limiting for production
      python apileaks.py scan \
        --target "$PRODUCTION_API_URL" \
        --jwt "$PRODUCTION_JWT_TOKEN" \
        --modules bola,auth \
        --rate-limit 1 \
        --output "prod-security-scan-$CI_PIPELINE_ID" \
        --log-level ERROR

  artifacts:
    when: always
    paths:
      - reports/
    expire_in: 90 days

  only:
    - schedules

  when: manual

# .gitlab-ci.yml with Docker
api-security-docker:
  stage: security-test
  image: docker:latest
  services:
    - docker:dind

  before_script:
    - docker build -t apileak .

  script:
    - |
      docker run --rm \
        -e API_ENDPOINT="$STAGING_API_URL" \
        -e JWT_TOKEN="$API_JWT_TOKEN" \
        -v $(pwd)/reports:/app/reports \
        apileak \
        python apileaks.py scan \
          --target "$API_ENDPOINT" \
          --jwt "$JWT_TOKEN" \
          --modules bola,auth,property \
          --rate-limit 3 \
          --output "docker-scan-$CI_PIPELINE_ID"

  artifacts:
    paths:
      - reports/

# docker-compose.test.yml
version: '3.8'

services:
  apileak:
    build: .
    environment:
      - API_ENDPOINT=${API_ENDPOINT}
      - JWT_TOKEN=${JWT_TOKEN}
      - MODULES=${MODULES:-bola,auth,property}
      - RATE_LIMIT=${RATE_LIMIT:-3}
    volumes:
      - ./reports:/app/reports
      - ./config:/app/config
    command: >
      scan
      --target ${API_ENDPOINT}
      --jwt ${JWT_TOKEN}
      --modules ${MODULES:-bola,auth,property}
      --rate-limit ${RATE_LIMIT:-3}
      --output docker-scan-$(date +%Y%m%d-%H%M%S)
      --log-level INFO

  # Service to serve reports
  report-server:
    image: nginx:alpine
    ports:
      - "8080:80"
    volumes:
      - ./reports:/usr/share/nginx/html
    depends_on:
      - apileak

# GitHub Actions - use secrets
env:
  JWT_TOKEN: ${{ secrets.API_JWT_TOKEN }}
  API_KEY: ${{ secrets.API_KEY }}

# GitLab CI - protected variables
variables:
  JWT_TOKEN: $API_JWT_TOKEN  # Protected variable in GitLab

# Jenkins - credentials binding
environment {
  JWT_TOKEN = credentials('api-jwt-token')
}