# CI/CD Integration

Run automated security scans on every deploy. Just one token — no service keys needed.

### How it works

1. **Create a project**  
   Add your app in the Supaguard dashboard
2. **Copy your token**  
   Find it in Project Settings → CI/CD
3. **Add to your pipeline**  
   One curl call — fails the build if score drops

## Quick Start

Trigger a scan with a single `curl` call. Replace `YOUR_PROJECT_TOKEN` with the token from your project settings.

```bash
curl -s -X POST \
  https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan \
  -H "Content-Type: application/json" \
  -d '{
    "token": "YOUR_PROJECT_TOKEN",
    "threshold": 50
  }'
```

**Response (pass)**

```json
{ "score": 82, "passed": true, "report_url": "..." }
```

**Response (fail) — HTTP 422**

```json
{ "score": 35, "passed": false, "report_url": "..." }
```

Safe by design: Your project token only triggers scans for the linked project. No database credentials, service keys, or user sessions are needed.

## GitHub Actions

Add this workflow to `.github/workflows/supaguard.yml`. It scans on every push to main and weekly on Monday mornings.

```yaml
name: Supaguard Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1' # Every Monday at 6 AM UTC

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run Supaguard Scan
        id: scan
        run: |
          RESPONSE=$(curl -sf -X POST \
            "https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan" \
            -H "Content-Type: application/json" \
            -d '{
              "token": "${{ secrets.SUPAGUARD_TOKEN }}",
              "threshold": 50
            }')

SCORE=$(echo "$RESPONSE" | jq -r '.score // empty')
          PASSED=$(echo "$RESPONSE" | jq -r '.passed // empty')
          REPORT=$(echo "$RESPONSE" | jq -r '.report_url // empty')

echo "score=$SCORE" >> "$GITHUB_OUTPUT"
          echo "report=$REPORT" >> "$GITHUB_OUTPUT"
          echo "Security Score: $SCORE/100"

if [ "$PASSED" = "false" ]; then
            echo "::error::Security score ($SCORE) is below threshold"
            exit 1
          fi

- name: Comment on PR
        if: github.event_name == 'pull_request'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: '**Supaguard Security Scan:** Score ${{ steps.scan.outputs.score }}/100 — [View Report](${{ steps.scan.outputs.report }})'
            })
```

**Required secret:**  
`SUPAGUARD_TOKEN`— your project token from Supaguard settings

## Shell Script

A standalone script for any CI system (GitLab CI, CircleCI, Jenkins, etc.). Exits with code 1 if the score is below the threshold.

```bash
#!/usr/bin/env bash
set -euo pipefail

# Supaguard CI/CD Security Scan
# Usage: SUPAGUARD_TOKEN=... ./supaguard-scan.sh [threshold]

TOKEN="${SUPAGUARD_TOKEN:?Set SUPAGUARD_TOKEN env var with your project token}"
THRESHOLD="${1:-50}"

echo "Running Supaguard scan..."

RESPONSE=$(curl -sf -X POST \
  "https://sdvginmpveophtabkxhm.supabase.co/functions/v1/trigger-scan" \
  -H "Content-Type: application/json" \
  -d "{
    \"token\": \"$TOKEN\",
    \"threshold\": $THRESHOLD
  }")

SCORE=$(echo "$RESPONSE" | jq -r '.score // empty')
PASSED=$(echo "$RESPONSE" | jq -r '.passed // empty')
PROJECT=$(echo "$RESPONSE" | jq -r '.project // empty')
REPORT=$(echo "$RESPONSE" | jq -r '.report_url // empty')

if [ -z "$SCORE" ]; then
  echo "Error: Could not parse scan result"
  echo "$RESPONSE" | jq . 2>/dev/null || echo "$RESPONSE"
  exit 1
fi

echo "Project:  $PROJECT"
echo "Score:    $SCORE/100 (threshold: $THRESHOLD)"
echo "Report:   $REPORT"

if [ "$PASSED" = "false" ]; then
  echo "FAIL: Score is below threshold"
  exit 1
fi

echo "PASS: Score meets threshold"
exit 0
```

**Usage:**  
`SUPAGUARD_TOKEN=abc123... ./supaguard-scan.sh 70`

## Security Badge

Display your security score on your README or docs site. The badge auto-updates after each scan. Find your token in Project Settings.

**Markdown**

```markdown

```

**HTML**

```html
<a href="https://supaguard.pro">
  <img src="https://sdvginmpveophtabkxhm.supabase.co/functions/v1/badge?token=YOUR_PROJECT_TOKEN" alt="Supaguard Security Score" />
</a>
```

**Badge styles**

**Shield (default)**

**Flat**

## API Reference

`POST``/functions/v1/trigger-scan`

### Request body

| Field     | Type   | Description                                          |
|-----------|--------|------------------------------------------------------|
| token     | string | Your project token (required)                        |
| threshold | number | Minimum passing score, 0-100 (default: 0)          |

### Response

| Field       | Description                            |
|-------------|----------------------------------------|
| score       | Security score (0-100)                |
| passed      | Whether score meets threshold          |
| report_url  | Link to full scan report              |
| tables_scanned | Number of tables analyzed         |
| project     | Project name                           |