name: MobSF Security Scan
on: [push]

jobs:
  mobsf-analysis:
    runs-on: ubuntu-latest
    env:
      # This fixes the 'externally-managed-environment' error
      PIP_BREAK_SYSTEM_PACKAGES: 1
    
    steps:
      - name: Checkout Code
        uses: https://github.com/actions/checkout@v4

      - name: Run mobsfscan
        # Use the MobSF action directly
        uses: https://github.com/MobSF/mobsfscan@main
        with:
          # '.' scans the whole repo. '--no-fail' prevents the pipeline from
          # stopping if it finds a bug, so we can still get the report.
          args: '. --html --output report.html --no-fail'

      # Safety step: if MobSF finds 0 bugs, it might not create the file.
      # We create a dummy file if it's missing so the Upload step doesn't crash.
      - name: Ensure Report Exists
        run: |
          if [ ! -f report.html ]; then
            echo "<html><body><h1>Scan Complete</h1><p>No vulnerabilities found.</p></body></html>" > report.html
          fi

      - name: Upload Report to Gitea
        uses: https://gitea.com/actions/upload-artifact@v3
        with:
          name: MobSF-Security-Report
          path: report.html