stages:
  - build
  - scan

build-scanner:
  stage: build
  script:
    - make -C scanner
  artifacts:
    paths:
      - scanner/undfscand
    expire_in: 1 hour

undf-scan:
  stage: scan
  needs: [build-scanner]
  script:
    - ./scanner/undfscand
        --registry UNDF-REGISTRY.json
        --defects defects/
        --target ${CI_PROJECT_DIR}
        --threads 4
        --format json
        --output scan-report.json
    - |
      python3 -c "
      import json, sys
      r = json.load(open('scan-report.json'))
      s = r['summary']
      print(f'UNDF Scan: {s[\"total\"]} checked | {s[\"patched\"]} patched | {s[\"unpatched\"]} UNPATCHED | {s[\"not_found\"]} not_found')
      unpatched = [f for f in r['findings'] if f['status'] == 'UNPATCHED']
      for f in unpatched:
          print(f'  !! {f[\"undf\"]} {f[\"defect_id\"]}: {f[\"evidence\"]}')
      sys.exit(1 if unpatched else 0)
      "
  artifacts:
    when: always
    paths:
      - scan-report.json
    expire_in: 30 days
  allow_failure: true