# Droidwatch APK Scan — Azure Pipelines step template.
#
# Drop this file into your repo (e.g. `.azure/droidwatch-scan.yml`) and call it
# from any pipeline:
#
#   steps:
#     - template: .azure/droidwatch-scan.yml
#       parameters:
#         apkPath:    '$(Build.ArtifactStagingDirectory)/app-release.apk'
#         apiKey:     $(DROIDWATCH_API_KEY)
#         failOn:     'Malicious|High Risk'
#
# Or reference it from a different repo via Azure's `templates` resource:
#
#   resources:
#     repositories:
#       - repository: droidwatch
#         type: github
#         name: anthropics/droidwatch
#         endpoint: 'GitHub'
#   steps:
#     - template: integrations/azure-pipelines/droidwatch-scan.yml@droidwatch
#       parameters:
#         apkPath: '$(Build.ArtifactStagingDirectory)/app-release.apk'
#         apiKey:  $(DROIDWATCH_API_KEY)

parameters:
  - name: apkPath
    type: string
    displayName: "Path to the .apk / .aab / .xapk / .dex"

  - name: apiKey
    type: string
    displayName: "Droidwatch API key (use $(DROIDWATCH_API_KEY) bound to a secret variable)"

  - name: serverUrl
    type: string
    default: "https://droidwatch.app"
    displayName: "Droidwatch base URL"

  - name: failOn
    type: string
    default: "Malicious"
    displayName: "Pipe-separated verdicts that fail the build"
    values:
      - "Malicious"
      - "Malicious|High Risk"
      - "Malicious|High Risk|Suspicious"

  - name: timeoutSeconds
    type: number
    default: 600

  - name: pollIntervalSeconds
    type: number
    default: 10

  - name: workingDirectory
    type: string
    default: "$(Agent.TempDirectory)"

steps:
  - bash: |
      set -eu
      for cmd in curl jq; do
        if ! command -v "$cmd" >/dev/null 2>&1; then
          echo "ERROR: '$cmd' missing from the agent — install it via a previous step." >&2
          exit 4
        fi
      done
      runner="$(mktemp -t droidwatch-scan.XXXXXX.sh)"
      echo "Downloading runner from ${DW_SERVER%/}/ci/lib/droidwatch-scan.sh"
      curl --fail --silent --show-error --location \
           -o "$runner" "${DW_SERVER%/}/ci/lib/droidwatch-scan.sh"
      chmod +x "$runner"

      DW_OUTPUT_FILE="$(Agent.TempDirectory)/droidwatch.env"
      export DW_OUTPUT_FILE
      bash "$runner"
      rc=$?

      # Re-emit each key=value as an Azure DevOps output variable so that
      # subsequent steps/jobs can reference $(DROIDWATCH_VERDICT) etc.
      if [ -f "$DW_OUTPUT_FILE" ]; then
        while IFS='=' read -r k v; do
          [ -z "$k" ] && continue
          upper=$(echo "$k" | tr '[:lower:]' '[:upper:]')
          echo "##vso[task.setvariable variable=DROIDWATCH_${upper};isoutput=true]$v"
        done < "$DW_OUTPUT_FILE"
      fi
      rm -f "$runner"
      exit $rc
    name: droidwatch_scan
    displayName: "Droidwatch APK Scan"
    workingDirectory: ${{ parameters.workingDirectory }}
    env:
      DW_APK_PATH:       ${{ parameters.apkPath }}
      DW_API_KEY:        ${{ parameters.apiKey }}
      DW_SERVER:         ${{ parameters.serverUrl }}
      DW_FAIL_ON:        ${{ parameters.failOn }}
      DW_TIMEOUT:        ${{ parameters.timeoutSeconds }}
      DW_POLL_INTERVAL:  ${{ parameters.pollIntervalSeconds }}

  - publish: $(Agent.TempDirectory)/droidwatch.env
    artifact: droidwatch.env
    condition: always()
    displayName: "Publish droidwatch.env artifact"