title: |-
  Droidwatch APK Scan
summary: |
  Upload an Android APK to Droidwatch, get a malware verdict, and (optionally)
  fail the build based on the verdict.
description: |
  Scans an Android APK for malware, banking trojans, overlay attacks, data
  exfiltration and 50+ threat categories using **Droidwatch**
  (https://droidwatch.app). Independent ML model (F1 0.9873 on CICMalDroid 2020)
  plus rule-engine and MITRE ATT&CK Mobile mapping.

  The step uploads the APK, waits for the analysis to finish, publishes the
  verdict / score / public report URL as environment variables for later
  steps, and (optionally) fails the build if the verdict matches your gate
  policy — typically "Malicious" for a default-deny pipeline.

  Get an API key at https://droidwatch.app → Profile → API keys.

website: https://droidwatch.app
source_code_url: https://github.com/anthropics/droidwatch/tree/main/integrations/bitrise
support_url: https://github.com/anthropics/droidwatch/issues

project_type_tags:
  - android
type_tags:
  - test
  - security

is_requires_admin_user: false
is_always_run: false
is_skippable: false

run_if: ""

deps:
  brew:
    - name: curl
    - name: jq
  apt_get:
    - name: curl
    - name: jq

toolkit:
  bash:
    entry_file: step.sh

inputs:
  - apk_path: $BITRISE_APK_PATH
    opts:
      title: APK path
      summary: Path to the .apk / .aab / .xapk / .dex file to scan.
      description: |
        Usually `$BITRISE_APK_PATH` (set by the Gradle Runner step) or
        `$BITRISE_DEPLOY_DIR/app-release.apk`.
      is_required: true

  - api_key: $DROIDWATCH_API_KEY
    opts:
      title: API key
      summary: Droidwatch API key (starts with `dw_`).
      description: |
        Create one at https://droidwatch.app → Profile → API keys.
        Mark this as **secret** in Bitrise (Workflow Editor → Secrets).
      is_required: true
      is_sensitive: true

  - server_url: "https://droidwatch.app"
    opts:
      title: Server URL
      summary: Droidwatch base URL. Override for self-hosted instances.
      is_required: true

  - fail_on: "Malicious"
    opts:
      title: Fail-on verdicts
      summary: |
        Pipe-separated list of verdicts that fail the build.
      description: |
        Examples:
          * `Malicious` (default) — only fail on confirmed malware
          * `Malicious|High Risk` — block high-risk builds
          * `Malicious|High Risk|Suspicious` — anything not Benign
      value_options:
        - "Malicious"
        - "Malicious|High Risk"
        - "Malicious|High Risk|Suspicious"

  - timeout_seconds: "600"
    opts:
      title: Timeout (seconds)
      summary: Max time to wait for the analysis.
      is_required: true

  - poll_interval_seconds: "10"
    opts:
      title: Poll interval (seconds)
      summary: How often to poll the job status.

outputs:
  - DROIDWATCH_RUN_ID:
    opts:
      title: Droidwatch run ID
      summary: UUID of the analysis run.

  - DROIDWATCH_VERDICT:
    opts:
      title: Verdict
      summary: One of `Benign` / `Suspicious` / `High Risk` / `Malicious`.

  - DROIDWATCH_SCORE:
    opts:
      title: Risk score
      summary: Integer 0–100; higher is more risky.

  - DROIDWATCH_REPORT_URL:
    opts:
      title: Public report URL
      summary: Shareable link to the full Droidwatch report.