name: Security Scan
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Scan PR for AI attacks
        env:
          SUPERAGENT_API_KEY: ${{ secrets.SUPERAGENT_API_KEY }}
          DAYTONA_API_KEY: ${{ secrets.DAYTONA_API_KEY }}
        run: |
          npx safety-agent-cli scan \
            --repo ${{ github.event.pull_request.head.repo.clone_url }} \
            --branch ${{ github.head_ref }}

- name: Scan and fail on issues
  run: |
    RESULT=$(npx safety-agent-cli scan --repo $REPO --branch $BRANCH)
    if echo "$RESULT" | grep -qi "threat\|injection\|malicious"; then
      echo "❌ Security issues detected"
      exit 1
    fi