name: Veracode Scans

on:
  pull_request:
    types: [opened, synchronize, reopened]
  merge_group:
    types: [ checks_requested ]
  push:
    branches: [main]

permissions:
  contents: write

jobs:
  veracode:
    runs-on: "ubuntu-latest"
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Create package (zip)
        # Scan shipped code only: exclude tests, build-time scripts, and generated output.
        run: zip -r package.zip . -x ".git/*" "tests/*" "docs/*" "*.md" "images/*" "tomtom-mcp.mcpb" ".github/*" "scripts/*" "*.test.ts" "node_modules/*" "dist/*" "coverage/*" "veracode-pipeline-scan-baseline-file.json"

      - name: Veracode Pipeline Scan (PR)
        if: ${{ github.event_name == 'pull_request' }}
        uses: veracode/Veracode-pipeline-scan-action@v1.0.20
        with:
          vid: ${{ secrets.VERACODE_API_ID }}
          vkey: ${{ secrets.VERACODE_API_KEY }}
          file: "package.zip"
          # Known findings are baselined (triage: docs/veracode-findings-triage.md),
          # so only NEW findings fail the build. To refresh the baseline, download
          # the veracode-full-results artifact from an accepted scan and replace
          # the baseline file.
          baseline_file: "veracode-pipeline-scan-baseline-file.json"
          fail_build: true

      - name: Fail if the scan did not actually run
        # The scan action exits 0 even when scan creation fails (e.g. HTTP 401
        # on invalid credentials), which produced green checks with no scan.
        # A completed scan always writes results.json.
        if: ${{ github.event_name == 'pull_request' }}
        run: test -s results.json || { echo "::error::Veracode pipeline scan produced no results (credential or upload failure) — check the scan step log"; exit 1; }

      - name: Upload full scan results
        # The scan action only uploads filtered_results.json; the full
        # results.json is needed to inspect findings and to (re)generate the
        # baseline file (see docs/veracode-findings-triage.md).
        if: ${{ github.event_name == 'pull_request' }}
        uses: actions/upload-artifact@v4
        with:
          name: veracode-full-results
          path: results.json

      - name: Veracode Policy Scan (main)
        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
        uses: veracode/veracode-uploadandscan-action@0.2.9
        with:
          vid: ${{ secrets.VERACODE_API_ID }}
          vkey: ${{ secrets.VERACODE_API_KEY }}
          appname: tomtom-international.tomtom-mcp
          filepath: "package.zip"
          deleteincompletescan: 2