# Excubitor pre-merge security gate, for .gitlab-ci.yml
#
#   include:
#     - local: 'gitlab-ci-excubitor-gate.yml'
#
# Reviews the files a merge request changed for AI-application security issues
# (OWASP LLM Top 10) and fails on HIGH or worse. With a console configured it
# files the result in your security ledger.
#
# ⛔ EXCUBITOR IS NEVER GIVEN ACCESS TO YOUR REPOSITORIES. This runs inside your
#    CI, which already has the access it needs, and reports outward.
#
# To file results in your ledger, set two CI/CD variables (masked, protected):
#   EXCUBITOR_CONSOLE_URL   the console you were given
#   EXCUBITOR_TOKEN         the ingest credential issued for this application
# Leave them unset and the gate still gates; it just reports nowhere.
excubitor-gate:
  stage: test
  image: python:3.12-slim
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  variables:
    GIT_DEPTH: 0              # the gate diffs against the target branch
  before_script:
    - pip install --no-cache-dir "excubitor-sdk[codereview]"
  script:
    - git fetch origin "$CI_MERGE_REQUEST_TARGET_BRANCH_NAME"
    - |
      git diff --name-only --diff-filter=ACM \
        "origin/$CI_MERGE_REQUEST_TARGET_BRANCH_NAME...HEAD" \
        | grep -E '\.(py|js|ts|jsx|tsx|java|go|rb|php|sh)$' > changed.txt || true
    - |
      if [ -s changed.txt ]; then
        excubitor-cigate $(cat changed.txt) --fail-on HIGH | tee review.md
      else
        echo "No reviewable files changed." | tee review.md
      fi
  artifacts:
    when: always
    paths:
      - review.md
    expire_in: 1 week