Integrate GeekWala into Your Workflow

https://geekwala.com/api/v1

GET /api/v1/projects/{project}/scans?page=2&per_page=50

GET /api/v1/scans/{id}/results?per_page=100&cursor=eyJpZCI6MTAwfQ

X-RateLimit-Limit: 120
X-RateLimit-Remaining: 115
X-RateLimit-Reset: 1609459200

async function apiCallWithRetry(url, options, maxRetries = 3) {
  for (let i = 0; i < maxRetries; i++) {
    const response = await fetch(url, options);
    if (response.status !== 429) return response;

    const retryAfter = response.headers.get('Retry-After');
    await new Promise(resolve =>
      setTimeout(resolve, (retryAfter || (i + 1)) * 1000)
    );
  }
  throw new Error('Max retries exceeded');
}

name: Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: GeekWala Security Scan
        uses: Geekwala/security-scan-action@v1
        with:
          api-token: ${{ secrets.GEEKWALA_API_TOKEN }}

- name: GeekWala Security Scan
  uses: Geekwala/security-scan-action@v1
  with:
    api-token: ${{ secrets.GEEKWALA_API_TOKEN }}

    # Severity gate: none, low, medium, high, critical
    severity-threshold: high

    # Fail on actively exploited vulnerabilities (CISA KEV)
    fail-on-kev: true

    # Fail if any vulnerability has >30% chance of exploitation
    epss-threshold: 0.3

    # Only fail on vulnerabilities that have a known fix
    only-fixed: true

- name: GeekWala Security Scan
  uses: Geekwala/security-scan-action@v1
  with:
    api-token: ${{ secrets.GEEKWALA_API_TOKEN }}
    file-path: packages/api/package-lock.json

- name: GeekWala Security Scan
  uses: Geekwala/security-scan-action@v1
  with:
    api-token: ${{ secrets.GEEKWALA_API_TOKEN }}
    sarif-file: geekwala-results.sarif
    severity-threshold: none  # Don't fail here; let Code Scanning handle alerts

- name: Upload SARIF to GitHub
  uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: geekwala-results.sarif

# .geekwala-ignore.yml
ignore:
  - id: CVE-2021-23337
    reason: "Not exploitable in our usage of lodash"
    expires: 2027-01-01  # Auto-unignore after this date

  - id: GHSA-xxxx-yyyy
    reason: "Accepted risk per security review #42"

- name: GeekWala Security Scan
  uses: Geekwala/security-scan-action@v1
  with:
    api-token: ${{ secrets.GEEKWALA_API_TOKEN }}
    severity-threshold: high

    # Output formats (comma-separated): summary, table, json
    output-format: summary,table,json

    # Save JSON report for CI artifacts
    json-file: scan-results.json

    # Reliability settings for slow CI environments
    retry-attempts: 3       # Retry transient failures (default: 3)
    timeout-seconds: 300    # Scan timeout (default: 300)

- name: Upload scan report
  if: always()
  uses: actions/upload-artifact@v4
  with:
    name: security-scan-results
    path: scan-results.json

- name: GeekWala Security Scan
  id: scan
  uses: Geekwala/security-scan-action@v1
  with:
    api-token: ${{ secrets.GEEKWALA_API_TOKEN }}
    severity-threshold: none  # Warn only

- name: Comment on PR
  if: steps.scan.outputs.has-vulnerabilities == 'true'
  run: |
    echo "Found ${{ steps.scan.outputs.vulnerable-packages }} vulnerable packages"
    echo "Critical: ${{ steps.scan.outputs.critical-count }}"
    echo "High: ${{ steps.scan.outputs.high-count }}"

# Scan package-lock.json and output summary
curl -sf -X POST "https://geekwala.com/api/v1/vulnerability-scan/run" \
  -H "Authorization: Bearer $GEEKWALA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"file_name\": \"package-lock.json\", \"content\": $(cat package-lock.json | jq -Rs .)}" \
  | jq '.data.summary'

# Output: { "total": 150, "affected": 3, "secure": 147, "totalVulnerabilities": 5 }

vulnerability_scan:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache curl jq
  script:
    - |
      RESPONSE=$(curl -sf -X POST "https://geekwala.com/api/v1/vulnerability-scan/run" \
        -H "Authorization: Bearer $GEEKWALA_API_TOKEN" \
        -H "Content-Type: application/json" \
        -d "{\"file_name\": \"package-lock.json\", \"content\": $(cat package-lock.json | jq -Rs .)}")

      # Parse results
      CRITICAL=$(echo "$RESPONSE" | jq -r '.data.results | map(select(.vulnerabilities[]?.severity == "critical")) | length')
      HIGH=$(echo "$RESPONSE" | jq -r '.data.results | map(select(.vulnerabilities[]?.severity == "high")) | length')

      echo "Critical: $CRITICAL, High: $HIGH"

      # Fail if critical or high found
      if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
        echo "Vulnerabilities found! Critical: $CRITICAL, High: $HIGH"
        exit 1
      fi
  # Optional: allow failure for non-blocking scans
  # allow_failure: true

pipeline {
  agent any
  environment {
    GEEKWALA_API_TOKEN = credentials('geekwala-api-token')
  }
  stages {
    stage('Vulnerability Scan') {
      steps {
        script {
          def response = sh(
            script: '''
              curl -sf -X POST "https://geekwala.com/api/v1/vulnerability-scan/run" \
                -H "Authorization: Bearer $GEEKWALA_API_TOKEN" \
                -H "Content-Type: application/json" \
                -d "{\"file_name\": \"package-lock.json\", \"content\": $(cat package-lock.json | jq -Rs .)}"
            ''',
            returnStdout: true
          ).trim()

          def json = readJSON text: response
          def critical = json.data.results.count { it.vulnerabilities?.any { v -> v.severity == 'critical' } }
          def high = json.data.results.count { it.vulnerabilities?.any { v -> v.severity == 'high' } }

          echo "Vulnerabilities - Critical: ${critical}, High: ${high}"

          if (critical > 0 || high > 0) {
            error "Found ${critical} critical and ${high} high severity vulnerabilities"
          }
        }
      }
    }
  }
}