mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-14 21:50:21 +02:00
feat: PR security gate, @neurosploit bot, richer NL REPL (#39)
GitHub automation - integrations: github_set_status (commit status), github_pr_review (REQUEST_CHANGES/APPROVE), github_pr_head_sha, and a shared severity gate (severity_rank / worst_confirmed_rank / gate_trips — confirmed findings only). - `neurosploit pr --fail-on <critical|high|medium|low>`: on a confirmed finding at/above the threshold, sets a failing `neurosploit/security` commit status, posts a REQUEST_CHANGES review, and exits 2 so a CI check fails — branch protection then blocks the merge. - Two ready GitHub Actions: neurosploit-pr-gate.yml (review + block every PR) and neurosploit-mention.yml (writers comment @neurosploit <text> to trigger a scan; any language; URL → black-box, else PR review). Natural-language REPL - Intent now also parses spoken toggles/knobs across PT/EN/ES: Burp/proxy, browser/MCP, subscription, "N votos/votes", recon depth (number or quick/deep/exhaustive), plus stop verbs. handle_nl returns the follow-up command (/run or /stop). Docs: README trimmed to features (version changelog stays in RELEASE.md), new automations documented in README + TUTORIAL-INTEGRATION. Tests: gate (3), NL toggles/stop (added). All green. Claude-Session: https://claude.ai/code/session_018BGLy4j5qsqqid6CoovowC Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Joas A Santos
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
21a62c95e5
commit
3786d7c559
@@ -0,0 +1,22 @@
|
||||
# NeuroSploit — GitHub Actions templates
|
||||
|
||||
Copy either file into your repository's `.github/workflows/` directory to enable
|
||||
the automation. Add an `ANTHROPIC_API_KEY` secret (Settings → Secrets and
|
||||
variables → Actions), or swap the `MODEL`/key for a provider you use. The built-in
|
||||
`GITHUB_TOKEN` already covers commit statuses, PR reviews and comments.
|
||||
|
||||
| Template | What it does |
|
||||
|----------|--------------|
|
||||
| `neurosploit-pr-gate.yml` | Reviews every pull request and **blocks the merge** on a confirmed critical (fails the check + sets a `neurosploit/security` commit status + posts a REQUEST_CHANGES review). |
|
||||
| `neurosploit-mention.yml` | Comment **`@neurosploit`** on a PR/issue (writers only) to trigger a scan. Text after the mention steers it, in any language; a URL runs a black-box test, otherwise it reviews the PR. |
|
||||
|
||||
## Enforce the PR gate as a merge block
|
||||
|
||||
1. Add `neurosploit-pr-gate.yml` to `.github/workflows/` and let it run once on a PR.
|
||||
2. Repo **Settings → Branches → Branch protection rule** on your default branch.
|
||||
3. Enable **Require status checks to pass** and select **`neurosploit-pr-gate`**.
|
||||
4. (Optional) Enable **Require a pull request review** so the REQUEST_CHANGES
|
||||
review it posts must be resolved/overridden before merge.
|
||||
|
||||
These live here (not in `.github/workflows/`) so this repo doesn't run them on
|
||||
itself — they're templates for **your** repo.
|
||||
@@ -0,0 +1,107 @@
|
||||
# NeuroSploit — @neurosploit mention bot
|
||||
#
|
||||
# Comment `@neurosploit` on a pull request or issue to trigger a scan:
|
||||
#
|
||||
# @neurosploit → white-box review of this PR
|
||||
# @neurosploit scan https://staging.app → black-box test of a URL
|
||||
# @neurosploit focus SQLi and IDOR → review this PR, steered
|
||||
#
|
||||
# Everything after `@neurosploit` is passed verbatim as the natural-language
|
||||
# instruction, so any language works. Results are posted back as a comment; on a
|
||||
# PR, a critical confirmed finding also blocks the merge (commit status + review).
|
||||
#
|
||||
# Guard: only members with write access can trigger it (checked below), so a
|
||||
# random commenter can't burn your model budget.
|
||||
|
||||
name: neurosploit-mention
|
||||
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
pull-requests: write
|
||||
statuses: write
|
||||
|
||||
jobs:
|
||||
dispatch:
|
||||
runs-on: ubuntu-latest
|
||||
# Only fire when the comment mentions the bot.
|
||||
if: contains(github.event.comment.body, '@neurosploit')
|
||||
steps:
|
||||
- name: Check the commenter has write access
|
||||
id: perm
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
|
||||
owner: context.repo.owner, repo: context.repo.repo,
|
||||
username: context.payload.comment.user.login,
|
||||
});
|
||||
const ok = ['admin', 'write', 'maintain'].includes(data.permission);
|
||||
core.setOutput('ok', ok ? 'yes' : 'no');
|
||||
if (!ok) core.notice('Ignoring @neurosploit from a non-writer.');
|
||||
|
||||
- name: React 👀 to acknowledge
|
||||
if: steps.perm.outputs.ok == 'yes'
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
await github.rest.reactions.createForIssueComment({
|
||||
owner: context.repo.owner, repo: context.repo.repo,
|
||||
comment_id: context.payload.comment.id, content: 'eyes',
|
||||
});
|
||||
|
||||
- name: Parse the instruction after @neurosploit
|
||||
if: steps.perm.outputs.ok == 'yes'
|
||||
id: parse
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const body = context.payload.comment.body || '';
|
||||
const m = body.match(/@neurosploit\s*([\s\S]*)/i);
|
||||
const instr = (m && m[1] ? m[1] : '').trim();
|
||||
const isPR = !!context.payload.issue.pull_request;
|
||||
// A URL in the instruction → black-box scan; otherwise review the PR.
|
||||
const url = (instr.match(/https?:\/\/\S+/) || [])[0] || '';
|
||||
core.setOutput('instr', instr);
|
||||
core.setOutput('is_pr', isPR ? 'yes' : 'no');
|
||||
core.setOutput('url', url);
|
||||
core.setOutput('number', String(context.payload.issue.number));
|
||||
|
||||
- name: Install NeuroSploit
|
||||
if: steps.perm.outputs.ok == 'yes'
|
||||
run: curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
|
||||
|
||||
- name: Enable the GitHub integration
|
||||
if: steps.perm.outputs.ok == 'yes'
|
||||
run: |
|
||||
export NEUROSPLOIT_BASE="$HOME/.neurosploit-app"
|
||||
"$HOME/.local/bin/neurosploit" integrations enable github
|
||||
|
||||
- name: Run the requested scan
|
||||
if: steps.perm.outputs.ok == 'yes'
|
||||
env:
|
||||
NEUROSPLOIT_BASE: /home/runner/.neurosploit-app
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
MODEL: anthropic:claude-opus-4-8
|
||||
INSTR: ${{ steps.parse.outputs.instr }}
|
||||
URL: ${{ steps.parse.outputs.url }}
|
||||
IS_PR: ${{ steps.parse.outputs.is_pr }}
|
||||
NUMBER: ${{ steps.parse.outputs.number }}
|
||||
run: |
|
||||
NS="$HOME/.local/bin/neurosploit"
|
||||
if [ -n "$URL" ]; then
|
||||
# Black-box scan of the URL the commenter named.
|
||||
"$NS" run "$URL" --model "$MODEL" ${INSTR:+--focus "$INSTR"} -v
|
||||
elif [ "$IS_PR" = "yes" ]; then
|
||||
# Review this PR (steered by any text after the mention), block on critical.
|
||||
"$NS" pr "${{ github.repository }}" "$NUMBER" \
|
||||
--model "$MODEL" --comment --fail-on critical -v
|
||||
else
|
||||
echo "Nothing to scan: mention a URL or comment on a PR." >&2
|
||||
exit 1
|
||||
fi
|
||||
@@ -0,0 +1,60 @@
|
||||
# NeuroSploit — PR security gate
|
||||
#
|
||||
# White-box reviews every pull request and BLOCKS the merge when a confirmed
|
||||
# finding is critical (configurable). It works two ways at once:
|
||||
# 1. `--fail-on` makes the CLI exit non-zero → this required check fails.
|
||||
# 2. `--fail-on` also sets a `neurosploit/security` commit status + a
|
||||
# REQUEST_CHANGES review via the API (needs the github integration on).
|
||||
#
|
||||
# Make it enforce a merge block: Settings → Branches → add a rule on your default
|
||||
# branch → "Require status checks to pass" → select **neurosploit-pr-gate**
|
||||
# (and/or "Require review from Code Owners" to honor the REQUEST_CHANGES review).
|
||||
#
|
||||
# Secrets/vars to set (Settings → Secrets and variables → Actions):
|
||||
# ANTHROPIC_API_KEY a model key (or swap MODEL + the matching key below)
|
||||
# GITHUB_TOKEN is provided automatically and is enough for statuses/reviews.
|
||||
|
||||
name: neurosploit-pr-gate
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write # post the REQUEST_CHANGES review + comment
|
||||
statuses: write # set the neurosploit/security commit status
|
||||
checks: write
|
||||
|
||||
concurrency:
|
||||
group: neurosploit-pr-${{ github.event.pull_request.number }}
|
||||
cancel-in-progress: true
|
||||
|
||||
jobs:
|
||||
gate:
|
||||
runs-on: ubuntu-latest
|
||||
# Skip forks — they don't get the secrets/token needed to review.
|
||||
if: github.event.pull_request.head.repo.full_name == github.repository
|
||||
steps:
|
||||
- name: Install NeuroSploit
|
||||
run: curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
|
||||
|
||||
- name: Enable the GitHub integration (for status + review)
|
||||
run: |
|
||||
export NEUROSPLOIT_BASE="$HOME/.neurosploit-app"
|
||||
"$HOME/.local/bin/neurosploit" integrations enable github
|
||||
|
||||
- name: Review the PR and enforce the gate
|
||||
env:
|
||||
NEUROSPLOIT_BASE: /home/runner/.neurosploit-app
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# Change the model + severity threshold to taste.
|
||||
MODEL: anthropic:claude-opus-4-8
|
||||
FAIL_ON: critical
|
||||
run: |
|
||||
"$HOME/.local/bin/neurosploit" pr "${{ github.repository }}" ${{ github.event.pull_request.number }} \
|
||||
--model "$MODEL" \
|
||||
--comment \
|
||||
--fail-on "$FAIL_ON" \
|
||||
-v
|
||||
Reference in New Issue
Block a user