export SMARTSCOPE_KEY="ss_live_your_key_here"

POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan
Authorization: Bearer <api-key>
Content-Type: application/json

curl -s -X POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -H "Content-Type: application/json" \
  -d @package.json

curl -s -X POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @requirements.txt

{
  "packages": [
    { "source": "npm",   "name": "lodash",  "version": "4.14.0" },
    { "source": "pypi",  "name": "django",  "version": "4.1.0"  },
    { "source": "npm",   "name": "express", "version": "4.18.0" }
  ]
}

{
  "summary": {
    "scanned":    3,
    "vulnerable": 1,   // packages with one or more CVEs at your version
    "outdated":   2,   // packages where version !== latestVersion
    "upToDate":   1,
    "critical":   0,
    "high":       1,
    "medium":     0,
    "low":        0
  },
  "packages": [
    {
      "name":          "lodash",
      "source":        "npm",
      "version":       "4.14.0",   // your installed version
      "latestVersion": "4.17.21",  // current registry version
      "upToDate":      false,
      "cves": [
        {
          "id":          "CVE-2021-23337",
          "severity":    "high",
          "summary":     "Command injection via template",
          "fixedIn":     "4.17.21",
          "publishedAt": "2021-02-15T00:00:00Z"
        }
      ]
    }
  ],
  "passed":  false,  // false = at least one CVE at or above failOn threshold
  "failOn":  "critical"
}

# Fail the pipeline if any high or critical CVE is found
curl -s -X POST "https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan?failOn=high" \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -d @package.json | jq -e '.passed'

Never commit your API key directly in the workflow file. Store it as a GitHub Secret (repo → Settings → Secrets and variables → Actions) and reference it as ${{ secrets.SMARTSCOPE_API_KEY }}. Committed secrets can be extracted from git history even after deletion.

env:
  # Space-separated paths — supports package.json and requirements.txt
  MANIFESTS: "frontend/package.json api/requirements.txt"
  FAIL_ON: "critical"   # critical | high | medium | low

- name: SmartScope security scan
  env:
    SMARTSCOPE_API_KEY: ${{ secrets.SMARTSCOPE_API_KEY }}
  run: |
    result=$(curl -sf -X POST \
      "https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan?failOn=high" \
      -H "Authorization: Bearer $SMARTSCOPE_API_KEY" \
      -H "Content-Type: application/json" \
      -d @package.json)

    echo "$result" | jq '.summary'

    if [ "$(echo "$result" | jq -r '.passed')" = "false" ]; then
      echo "::error::SmartScope: vulnerabilities found — see summary above"
      exit 1
    fi

smartscope-scan:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      result=$(curl -sf -X POST \
        "https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan?failOn=high" \
        -H "Authorization: Bearer $SMARTSCOPE_KEY" \
        -H "Content-Type: application/json" \
        -d @package.json)

      echo "$result" | jq '.summary'

      passed=$(echo "$result" | jq -r '.passed')
      if [ "$passed" = "false" ]; then
        echo "Vulnerabilities found:"
        echo "$result" | jq '.packages[] | select(.cves | length > 0)'
        exit 1
      fi
  only:
    - merge_requests
    - main

The PR comment step uses $(System.AccessToken). For this to work, go to Pipelines → Edit → ⋯ → Triggers → YAML → Get sources and enable Allow scripts to access the OAuth token. Without it the comment post will 401 — the scan itself will still run fine.

trigger: none  # triggered via Branch Policy, not YAML pr: block

variables:
  MANIFESTS: 'package.json'  # space-separated manifest paths
  FAIL_ON: 'critical'         # critical | high | medium | low

jobs:
  - job: SmartScope
    displayName: SmartScope scan
    pool:
      vmImage: ubuntu-latest

    steps:
      - checkout: self

      - bash: |
          rm -f /tmp/ss-comment.md
          OVERALL_PASSED=true

          for MANIFEST in $(MANIFESTS); do
            if [ ! -f "$MANIFEST" ]; then
              echo "Skipping $MANIFEST — file not found"
              continue
            fi

            RESULT=$(curl -sf \
              -X POST "https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan?failOn=$(FAIL_ON)" \
              -H "Authorization: Bearer $SMARTSCOPE_API_KEY" \
              -H "Content-Type: application/json" \
              --data-binary "@$MANIFEST")

            PASSED=$(echo "$RESULT" | jq -r '.passed')
            SCANNED=$(echo "$RESULT" | jq -r '.summary.scanned')
            VULNERABLE=$(echo "$RESULT" | jq -r '.summary.vulnerable')
            CRITICAL=$(echo "$RESULT" | jq -r '.summary.critical')
            HIGH=$(echo "$RESULT" | jq -r '.summary.high')
            MEDIUM=$(echo "$RESULT" | jq -r '.summary.medium')
            LOW=$(echo "$RESULT" | jq -r '.summary.low')
            OUTDATED=$(echo "$RESULT" | jq -r '.summary.outdated')

            [ "$PASSED" = "false" ] && OVERALL_PASSED=false
            if [ "$PASSED" = "true" ]; then STATUS="Passed"; else STATUS="Failed"; fi

            printf '### %s — %s\n' "$STATUS" "$MANIFEST" >> /tmp/ss-comment.md
            printf '> Scanned **%s** packages · **%s** vulnerable · **%s** outdated  \n' \
              "$SCANNED" "$VULNERABLE" "$OUTDATED" >> /tmp/ss-comment.md
            printf '> Critical: **%s** · High: **%s** · Medium: **%s** · Low: **%s**\n\n' \
              "$CRITICAL" "$HIGH" "$MEDIUM" "$LOW" >> /tmp/ss-comment.md

            VULN_ROWS=$(echo "$RESULT" | jq -r '
              .packages[] | select(.cves | length > 0) |
              "| " + .name + " | " + (.version // "—") + " | " + (.latestVersion // "—") + " | " + (.cves | map(.id + " (" + .severity + ")") | join(", ")) + " |"
            ')

            if [ -n "$VULN_ROWS" ]; then
              printf '| Package | Version | Latest | CVEs |\n|---------|---------|--------|------|\n' >> /tmp/ss-comment.md
              printf '%s\n\n' "$VULN_ROWS" >> /tmp/ss-comment.md
            fi
          done

          printf '%s
' '---' '*[SmartScope](https://mysmartscope.com)*' >> /tmp/ss-comment.md

          if [ -n "$SYSTEM_PULLREQUEST_PULLREQUESTID" ]; then
            PAYLOAD=$(jq -n --rawfile content /tmp/ss-comment.md \
              '{comments:[{parentCommentId:0,content:$content,commentType:1}],status:1}')

            curl -sf -X POST \
              "$SYSTEM_TEAMFOUNDATIONCOLLECTIONURI$SYSTEM_TEAMPROJECT/_apis/git/repositories/$BUILD_REPOSITORY_ID/pullRequests/$SYSTEM_PULLREQUEST_PULLREQUESTID/threads?api-version=7.1" \
              -H "Authorization: Bearer $SYSTEM_ACCESSTOKEN" \
              -H "Content-Type: application/json" \
              -d "$PAYLOAD"
          fi

          [ "$OVERALL_PASSED" = "true" ] || exit 1
        displayName: Scan dependencies and post PR comment
        env:
          SMARTSCOPE_API_KEY: $(SMARTSCOPE_API_KEY)
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)

# Quick scan — prints summary, exits 1 if critical CVEs found
curl -sf -X POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -d @package.json | jq '{summary: .summary, passed: .passed}'

curl -sf -X POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -d @package.json \
  | jq '.packages[] | select(.cves | length > 0) | {name, version, latestVersion, cves}'

curl -sf -X POST https://rtw7o67sla.execute-api.us-east-1.amazonaws.com/v1/scan \
  -H "Authorization: Bearer $SMARTSCOPE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @requirements.txt | jq '.summary'