stages:
  - security

vibeguard:
  stage: security
  image: node:20
  before_script:
    - npm ci
    - npm install -g vibeguard
    # Install gitleaks
    - curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.18.0/gitleaks_8.18.0_linux_x64.tar.gz | tar -xz
    - mv gitleaks /usr/local/bin/
    # Install osv-scanner
    - curl -sSfL https://github.com/google/osv-scanner/releases/download/v1.7.0/osv-scanner_linux_amd64 -o /usr/local/bin/osv-scanner
    - chmod +x /usr/local/bin/osv-scanner
    # Install semgrep
    - pip install semgrep
  script:
    - vg ci --format json > vibeguard-results.json || true
    - vg ci --fail-on error
  artifacts:
    when: always
    paths:
      - vibeguard-results.json
    reports:
      codequality: vibeguard-results.json
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH