mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-08-14 13:40:23 +02:00
3786d7c559
GitHub automation - integrations: github_set_status (commit status), github_pr_review (REQUEST_CHANGES/APPROVE), github_pr_head_sha, and a shared severity gate (severity_rank / worst_confirmed_rank / gate_trips — confirmed findings only). - `neurosploit pr --fail-on <critical|high|medium|low>`: on a confirmed finding at/above the threshold, sets a failing `neurosploit/security` commit status, posts a REQUEST_CHANGES review, and exits 2 so a CI check fails — branch protection then blocks the merge. - Two ready GitHub Actions: neurosploit-pr-gate.yml (review + block every PR) and neurosploit-mention.yml (writers comment @neurosploit <text> to trigger a scan; any language; URL → black-box, else PR review). Natural-language REPL - Intent now also parses spoken toggles/knobs across PT/EN/ES: Burp/proxy, browser/MCP, subscription, "N votos/votes", recon depth (number or quick/deep/exhaustive), plus stop verbs. handle_nl returns the follow-up command (/run or /stop). Docs: README trimmed to features (version changelog stays in RELEASE.md), new automations documented in README + TUTORIAL-INTEGRATION. Tests: gate (3), NL toggles/stop (added). All green. Claude-Session: https://claude.ai/code/session_018BGLy4j5qsqqid6CoovowC Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
61 lines
2.4 KiB
YAML
61 lines
2.4 KiB
YAML
# NeuroSploit — PR security gate
|
|
#
|
|
# White-box reviews every pull request and BLOCKS the merge when a confirmed
|
|
# finding is critical (configurable). It works two ways at once:
|
|
# 1. `--fail-on` makes the CLI exit non-zero → this required check fails.
|
|
# 2. `--fail-on` also sets a `neurosploit/security` commit status + a
|
|
# REQUEST_CHANGES review via the API (needs the github integration on).
|
|
#
|
|
# Make it enforce a merge block: Settings → Branches → add a rule on your default
|
|
# branch → "Require status checks to pass" → select **neurosploit-pr-gate**
|
|
# (and/or "Require review from Code Owners" to honor the REQUEST_CHANGES review).
|
|
#
|
|
# Secrets/vars to set (Settings → Secrets and variables → Actions):
|
|
# ANTHROPIC_API_KEY a model key (or swap MODEL + the matching key below)
|
|
# GITHUB_TOKEN is provided automatically and is enough for statuses/reviews.
|
|
|
|
name: neurosploit-pr-gate
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write # post the REQUEST_CHANGES review + comment
|
|
statuses: write # set the neurosploit/security commit status
|
|
checks: write
|
|
|
|
concurrency:
|
|
group: neurosploit-pr-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
gate:
|
|
runs-on: ubuntu-latest
|
|
# Skip forks — they don't get the secrets/token needed to review.
|
|
if: github.event.pull_request.head.repo.full_name == github.repository
|
|
steps:
|
|
- name: Install NeuroSploit
|
|
run: curl -fsSL https://raw.githubusercontent.com/JoasASantos/NeuroSploit/main/setup.sh | bash
|
|
|
|
- name: Enable the GitHub integration (for status + review)
|
|
run: |
|
|
export NEUROSPLOIT_BASE="$HOME/.neurosploit-app"
|
|
"$HOME/.local/bin/neurosploit" integrations enable github
|
|
|
|
- name: Review the PR and enforce the gate
|
|
env:
|
|
NEUROSPLOIT_BASE: /home/runner/.neurosploit-app
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
# Change the model + severity threshold to taste.
|
|
MODEL: anthropic:claude-opus-4-8
|
|
FAIL_ON: critical
|
|
run: |
|
|
"$HOME/.local/bin/neurosploit" pr "${{ github.repository }}" ${{ github.event.pull_request.number }} \
|
|
--model "$MODEL" \
|
|
--comment \
|
|
--fail-on "$FAIL_ON" \
|
|
-v
|