# Droidwatch APK Scan — GitLab CI/CD template
#
# Drop this into your .gitlab-ci.yml to scan every build:
#
#   include:
#     - remote: 'https://droidwatch.app/ci/gitlab/scan.yml'
#
#   variables:
#     DROIDWATCH_APK_PATH: app/build/outputs/apk/release/app-release.apk
#     DROIDWATCH_FAIL_ON:  "Malicious|High Risk"   # optional, default: Malicious
#
#   # Make the API key a masked + protected variable in
#   #   Settings → CI/CD → Variables → DROIDWATCH_API_KEY
#
# The job will:
#   1. Upload the APK to Droidwatch.
#   2. Wait for the analysis to finish (default 10-min cap).
#   3. Publish the verdict, score and public report URL as job artifacts and
#      as `dotenv` outputs you can read from later jobs.
#   4. Fail the pipeline if the verdict matches DROIDWATCH_FAIL_ON.
#
# Outputs (consume in later jobs via `needs: [droidwatch_scan]`):
#   DROIDWATCH_RUN_ID
#   DROIDWATCH_VERDICT
#   DROIDWATCH_SCORE
#   DROIDWATCH_REPORT_URL

variables:
  DROIDWATCH_SERVER: "https://droidwatch.app"
  DROIDWATCH_FAIL_ON: "Malicious"
  DROIDWATCH_TIMEOUT: "600"
  DROIDWATCH_POLL_INTERVAL: "10"

droidwatch_scan:
  stage: test
  image: alpine:3.20
  rules:
    - if: '$DROIDWATCH_API_KEY == null'
      when: never
    - when: on_success
  before_script:
    - apk add --no-cache bash curl jq
    - curl -fsSL "${DROIDWATCH_SERVER}/ci/lib/droidwatch-scan.sh" -o /tmp/droidwatch-scan.sh
    - chmod +x /tmp/droidwatch-scan.sh
  script:
    - |
      DW_APK_PATH="${DROIDWATCH_APK_PATH:?DROIDWATCH_APK_PATH must be set}" \
      DW_API_KEY="${DROIDWATCH_API_KEY:?DROIDWATCH_API_KEY must be set (masked variable)}" \
      DW_SERVER="${DROIDWATCH_SERVER}" \
      DW_FAIL_ON="${DROIDWATCH_FAIL_ON}" \
      DW_TIMEOUT="${DROIDWATCH_TIMEOUT}" \
      DW_POLL_INTERVAL="${DROIDWATCH_POLL_INTERVAL}" \
      DW_OUTPUT_FILE="droidwatch.env" \
      /tmp/droidwatch-scan.sh
    # Re-publish under the DROIDWATCH_ prefix so consumer jobs have a stable namespace.
    - sed 's/^/DROIDWATCH_/' droidwatch.env | tr '[:lower:]' '[:upper:]' > droidwatch.gitlab.env
  artifacts:
    name: "droidwatch-scan-${CI_COMMIT_SHORT_SHA}"
    when: always
    expire_in: 30 days
    reports:
      dotenv: droidwatch.gitlab.env
    paths:
      - droidwatch.env