ci: set CI=true in test workflow (#217)

* ci: explicitly set CI=true in test workflow

* fix: render findings detail in PR comment, add Claude AI review support

* fix: pipe only stdout (JSON) to scan file, let stderr display separately

* fix: extract JSON from vu1nz output (progress lines precede JSON on stdout)

* fix: strip ANSI escape codes from vu1nz JSON output before parsing

* fix: disable color output (NO_COLOR/TERM=dumb), use python to extract JSON

* fix: use json.loads(strict=False) to handle unescaped newlines in vu1nz output

* fix: use raw_decode to extract JSON object, ignore trailing output

* fix: use review-pr to scan PR code for vulns, not actions scan

* feat: use review-pr to scan PR code for vulns with Claude AI

* fix: extract ANTHROPIC_API_KEY from ENV_FILE secret

* debug: list ENV_FILE key names to find ANTHROPIC_API_KEY

* ci: retrigger vu1nz scan after ENV_FILE update

Author: Preshy

.github/workflows/test.yml

@@ -23,3 +23,5 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - run: pnpm test
+        env:
+          CI: true

.github/workflows/vu1nz-scan.yml

@@ -2,17 +2,14 @@ name: vu1nz security scan
 
 on:
   pull_request:
-  push:
-    branches: [master]
 
 permissions:
   contents: read
-  actions: read
   pull-requests: write
 
 jobs:
-  scan:
-    name: Scan CI/CD for vulnerabilities
+  review:
+    name: Review PR for security vulnerabilities
     runs-on: ubuntu-latest
 
     steps:
@@ -25,69 +22,148 @@ jobs:
       - name: Install vu1nz
         run: pip install --quiet git+https://github.com/profullstack/vu1nz-gh-actions.git
 
-      - name: Scan workflows
-        id: scan
+      - name: Load env file
+        env:
+          ENV_FILE: ${{ secrets.ENV_FILE }}
+        run: |
+          echo "$ENV_FILE" > "$RUNNER_TEMP/.env"
+          # Debug: show available key names only (no values)
+          echo "Keys in ENV_FILE:"
+          grep -oP '^[A-Z_]+(?==)' "$RUNNER_TEMP/.env" || echo "(no keys found or different format)"
+          # Export ANTHROPIC_API_KEY from the env file
+          ANTHROPIC_API_KEY=$(grep -E '^ANTHROPIC_API_KEY=' "$RUNNER_TEMP/.env" | head -1 | sed 's/^ANTHROPIC_API_KEY=//')
+          if [ -n "$ANTHROPIC_API_KEY" ]; then
+            echo "::add-mask::$ANTHROPIC_API_KEY"
+            echo "ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY" >> "$GITHUB_ENV"
+            echo "ANTHROPIC_API_KEY found and exported"
+          else
+            echo "::warning::ANTHROPIC_API_KEY not found in ENV_FILE"
+          fi
+
+      - name: Review PR
+        id: review
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NO_COLOR: "1"
+          TERM: dumb
         run: |
-          vu1nz actions scan ${{ github.repository }} \
+          vu1nz review-pr main \
+            ${{ github.repository }} \
+            ${{ github.event.pull_request.number }} \
             --token "$GITHUB_TOKEN" \
             --json \
-            2>&1 | tee "$RUNNER_TEMP/vu1nz-scan.json"
-
-      - name: Evaluate findings
-        id: eval
+            | tee "$RUNNER_TEMP/vu1nz-review-raw.txt" || true
+
+          # Extract JSON from output (vu1nz prints progress lines before JSON)
+          python3 -c "
+          import json, re, sys
+          raw = open('$RUNNER_TEMP/vu1nz-review-raw.txt').read()
+          raw = re.sub(r'\x1b\[[0-9;]*m', '', raw)
+          start = raw.find('{')
+          if start >= 0:
+              obj, _ = json.JSONDecoder(strict=False).raw_decode(raw, start)
+              json.dump(obj, sys.stdout)
+          else:
+              print('{}')
+          " > "$RUNNER_TEMP/vu1nz-review.json"
+
+      - name: Build PR comment
+        id: comment
         run: |
           python3 << 'PYEOF'
           import json, os, sys
 
-          scan_file = os.environ.get("RUNNER_TEMP", "") + "/vu1nz-scan.json"
+          review_file = os.environ.get("RUNNER_TEMP", "") + "/vu1nz-review.json"
+          comment_file = os.environ.get("RUNNER_TEMP", "") + "/vu1nz-comment.md"
+
           try:
-              with open(scan_file) as f:
-                  data = json.load(f)
+              with open(review_file) as f:
+                  data = json.loads(f.read(), strict=False)
           except Exception as e:
-              print(f"::warning::Could not parse scan results: {e}")
+              print(f"::warning::Could not parse review results: {e}")
+              with open(comment_file, "w") as f:
+                  f.write("## vu1nz Security Review\n\nCould not parse review results.\n")
               sys.exit(0)
 
           findings = data.get("findings", [])
-          counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
-          for f in findings:
-              sev = f.get("severity", "").lower()
+          analysis = data.get("analysis", "")
+          pr = data.get("pr_number", "?")
+          total = len(findings)
+
+          counts = {"critical": 0, "high": 0, "medium": 0, "low": 0}
+          for finding in findings:
+              sev = finding.get("severity", "").lower()
               if sev in counts:
                   counts[sev] += 1
 
-          total = len(findings)
           has_hc = counts["critical"] > 0 or counts["high"] > 0
 
-          parts = [f"**{total} findings**"]
+          lines = ["## vu1nz Security Review", ""]
+          lines.append(f"**{total}** finding(s) in PR #{pr}")
+          lines.append("")
+
+          badge_parts = []
           for sev in ("critical", "high", "medium", "low"):
               if counts[sev] > 0:
-                  parts.append(f"{sev}: {counts[sev]}")
-          summary = " | ".join(parts)
+                  badge_parts.append(f"**{sev.upper()}**: {counts[sev]}")
+          if badge_parts:
+              lines.append(" | ".join(badge_parts))
+              lines.append("")
+
+          if has_hc:
+              lines.append("> **High or critical findings — review before merging.**")
+              lines.append("")
+
+          if findings:
+              lines.append("### Findings")
+              lines.append("")
+              lines.append("| Severity | File | Issue | Suggestion |")
+              lines.append("|----------|------|-------|------------|")
+              for f in findings:
+                  sev = f.get("severity", "?").upper()
+                  file = f.get("file", "N/A")
+                  issue = f.get("issue", "").replace("\n", " ")[:150]
+                  suggestion = f.get("suggestion", "").replace("\n", " ")[:150]
+                  lines.append(f"| {sev} | `{file}` | {issue} | {suggestion} |")
+              lines.append("")
+          else:
+              lines.append("No security issues found.")
+              lines.append("")
+
+          if analysis:
+              lines.append("<details><summary>Full AI Analysis</summary>")
+              lines.append("")
+              lines.append(analysis)
+              lines.append("")
+              lines.append("</details>")
+
+          body = "\n".join(lines)
+          with open(comment_file, "w") as f:
+              f.write(body)
 
           with open(os.environ.get("GITHUB_OUTPUT", ""), "a") as out:
               out.write(f"total={total}\n")
               out.write(f"has_high_critical={'true' if has_hc else 'false'}\n")
-              out.write(f"summary={summary}\n")
 
           if has_hc:
-              print(f"::error::vu1nz found high/critical CI/CD vulnerabilities")
+              print(f"::error::vu1nz found high/critical vulnerabilities in PR code")
               sys.exit(1)
 
-          print(f"::notice::{summary}")
+          print(f"::notice::vu1nz review: {total} finding(s), no high/critical issues")
           PYEOF
 
       - name: Comment on PR
-        if: github.event_name == 'pull_request' && always()
+        if: always()
         uses: actions/github-script@v7
         with:
           script: |
-            const summary = `${{ steps.eval.outputs.summary || 'Scan completed.' }}`;
-            const hasHC = '${{ steps.eval.outputs.has_high_critical }}' === 'true';
-
-            let body = `## vu1nz CI/CD Security Scan\n\n${summary}\n\n`;
-            if (hasHC) {
-              body += '**High or critical findings detected — review before merging.**\n\n';
+            const fs = require('fs');
+            const commentFile = `${process.env.RUNNER_TEMP}/vu1nz-comment.md`;
+            let body;
+            try {
+              body = fs.readFileSync(commentFile, 'utf8');
+            } catch {
+              body = '## vu1nz Security Review\n\nScan completed but could not read results.';
             }
 
             const { data: comments } = await github.rest.issues.listComments({
@@ -97,7 +173,7 @@ jobs:
             });
 
             const existing = comments.find(c =>
-              c.user.type === 'Bot' && c.body.includes('vu1nz CI/CD Security Scan')
+              c.user.type === 'Bot' && c.body.includes('vu1nz Security Review')
             );
 
             if (existing) {