CI/CDでDASTスキャンを実行

#!/usr/bin/env bash
set -euo pipefail

AIKIDO_URL="${AIKIDO_URL:-https://app.aikido.dev}"
API="$AIKIDO_URL/api/public/v1"
DOMAIN_ID="${AIKIDO_DOMAIN_ID:?Set AIKIDO_DOMAIN_ID}"
SEVERITIES="${SEVERITIES:-critical,high}"
TIMEOUT_SECONDS="${TIMEOUT_SECONDS:-3600}"
POLL_SECONDS=30

# 1. Get an access token with the client credentials flow.
# Tokens expire after 1 hour, so the script refreshes it before each call.
refresh_token() {
  TOKEN=$(curl -sf -X POST "$AIKIDO_URL/api/oauth/token" \
    -u "$AIKIDO_CLIENT_ID:$AIKIDO_CLIENT_SECRET" \
    -H "Content-Type: application/json" \
    -d '{"grant_type": "client_credentials"}' | jq -r '.access_token')
  auth=(-H "Authorization: Bearer $TOKEN")
}

# Prints last_scanned_at (unix timestamp) of the domain, or 0 if it was never scanned
last_scanned_at() {
  local page=0 result found
  refresh_token
  while :; do
    result=$(curl -sf "${auth[@]}" "$API/domains?page=$page&per_page=100")
    [ "$(jq 'length' <<<"$result")" -eq 0 ] && { echo "Domain $DOMAIN_ID not found" >&2; exit 1; }
    found=$(jq -r --argjson id "$DOMAIN_ID" \
      '.[] | select(.id == $id) | (.last_scanned_at // 0 | tonumber)' <<<"$result")
    [ -n "$found" ] && { echo "$found"; return; }
    page=$((page + 1))
  done
}

# 2. Start the scan
refresh_token
STARTED_AT=$(date +%s)
curl -sf -X POST "${auth[@]}" "$API/domains/scan" \
  -H "Content-Type: application/json" \
  -d "{\"domain_id\": $DOMAIN_ID}" > /dev/null
echo "Started scan for domain $DOMAIN_ID"

# 3. Wait until the scan has finished
while :; do
  # Assign first so a failing lookup (e.g. unknown domain ID) aborts the script
  LAST=$(last_scanned_at)
  [ "$LAST" -ge "$STARTED_AT" ] && break
  if [ $(( $(date +%s) - STARTED_AT )) -ge "$TIMEOUT_SECONDS" ]; then
    echo "Scan did not finish within $TIMEOUT_SECONDS seconds" >&2
    exit 1
  fi
  echo "Scan running, checking again in $POLL_SECONDS seconds"
  sleep "$POLL_SECONDS"
done
echo "Scan finished"

# 4. Export open issues for this domain
refresh_token
ISSUES=$(curl -sf "${auth[@]}" -G "$API/issues/export" \
  --data-urlencode "format=json" \
  --data-urlencode "per_page=5000" \
  --data-urlencode "filter_status=open" \
  --data-urlencode "filter_domain_id=$DOMAIN_ID" \
  --data-urlencode "filter_severities=$SEVERITIES")

COUNT=$(jq 'length' <<<"$ISSUES")
if [ "$COUNT" -gt 0 ]; then
  echo "Found $COUNT open issue(s) with severity $SEVERITIES:"
  jq -r '.[] | "- [\(.severity)] \(.rule) (\(.domain_name))"' <<<"$ISSUES"
  exit 1
fi

echo "No open issues with severity $SEVERITIES"

name: Deploy staging and run DAST

on:
  push:
    branches: [main]

jobs:
  deploy-staging:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to staging
        run: echo "Replace with your deploy steps"

  dast-scan:
    needs: deploy-staging
    runs-on: ubuntu-latest
    timeout-minutes: 75
    steps:
      - uses: actions/checkout@v4
      - name: Run Aikido DAST scan
        run: bash scripts/aikido-dast-scan.sh
        env:
          AIKIDO_CLIENT_ID: ${{ secrets.AIKIDO_CLIENT_ID }}
          AIKIDO_CLIENT_SECRET: ${{ secrets.AIKIDO_CLIENT_SECRET }}
          AIKIDO_DOMAIN_ID: ${{ vars.AIKIDO_DOMAIN_ID }}
          # Uncomment if your workspace is not in the EU region
          # AIKIDO_URL: https://app.us.aikido.dev