CI integration¶

# OpenComplAI compliance scan — GitHub Actions
#
# Copy this file to .github/workflows/opencomplai-scan.yml in your AI system
# repository. Requires a system-manifest.json in your repo root (see the
# CLI's own `opencomplai init`).
#
# Before this runs, add your API key as a repository secret:
#   Settings -> Secrets and variables -> Actions -> New repository secret
#   Name:  OPENCOMPLAI_API_KEY
#   Value: the key you issued on the project's page in this dashboard
name: OpenComplAI compliance scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  opencomplai-scan:
    name: OpenComplAI compliance scan
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "3.11"

      - name: Install OpenComplAI CLI
        run: pip install opencomplai

      - name: Run OpenComplAI compliance scan
        run: opencomplai-gha-connector
        env:
          # Exit-code contract (opencomplai check / opencomplai-gha-connector):
          #   0 = pass             scan passed (or degraded_complete in local scan mode)
          #   1 = control_fail     a required control failed
          #   2 = validation_fail  manifest or input validation error
          #   3 = policy_block     prohibited system (EU AI Act Article 5)
          #   4 = trap_detected    Article 25 substantial-modification freeze
          #
          # This dashboard's own ingest endpoint — safe to commit as plain
          # text, it is not a secret.
          OPENCOMPLAI_DASHBOARD_URL: https://YOUR-DASHBOARD-HOST/api/ingest
          # Set in this repository's (or organization's) Actions secrets —
          # never commit the key itself.
          OPENCOMPLAI_API_KEY: ${{ secrets.OPENCOMPLAI_API_KEY }}
#
# Optional scheduled re-run. To use it, remove the leading "# " from each line below
# and save the result as .github/workflows/opencomplai-rerun.yml.
# name: OpenComplAI re-run
#
# on:
#   schedule:
#     - cron: "0 6 * * 1,4"
#   workflow_dispatch:
#
# permissions:
#   contents: read
#
# jobs:
#   opencomplai-rerun:
#     runs-on: ubuntu-latest
#     steps:
#       - name: Checkout repository
#         uses: actions/checkout@v7
#
#       - name: Set up Python
#         uses: actions/setup-python@v6
#         with:
#           python-version: "3.11"
#
#       - name: Install OpenComplAI CLI
#         run: pip install --upgrade opencomplai
#
#       - name: Restore the last baseline
#         uses: actions/cache@v4
#         with:
#           path: baseline
#           key: opencomplai-baseline-${{ github.run_id }}
#           restore-keys: opencomplai-baseline-
#
#       - name: Check, diff against the baseline, keep the new baseline
#         run: |
#           CHECK_EXIT=0
#           opencomplai check --with-gaps || CHECK_EXIT=$?
#           DIFF_EXIT=0
#           if [ -f baseline/compliance-artifact.json ] && [ -f compliance-artifact.json ]; then
#             opencomplai diff baseline/compliance-artifact.json compliance-artifact.json --fail-on-regression || DIFF_EXIT=$?
#           fi
#           if [ -f compliance-artifact.json ]; then
#             mkdir -p baseline
#             cp compliance-artifact.json baseline/compliance-artifact.json
#           fi
#           if [ "$DIFF_EXIT" -ne 0 ]; then exit "$DIFF_EXIT"; fi
#           exit "$CHECK_EXIT"

# OpenComplAI compliance scan — GitLab CI
#
# Copy this into your .gitlab-ci.yml (or `include:` it) in your AI system
# repository. Requires a system-manifest.json in your repo root (see the
# CLI's own `opencomplai init`).
#
# Before this runs, add your API key as a masked CI/CD variable:
#   Settings -> CI/CD -> Variables -> Add variable
#   Key:   OPENCOMPLAI_API_KEY
#   Value: the key you issued on the project's page in this dashboard
#   Flags: Protect variable, Mask variable
opencomplai-scan:
  image: python:3.11
  before_script:
    - pip install opencomplai
  script:
    - opencomplai-gitlab-connector
  artifacts:
    reports:
      junit: opencomplai-report.xml
    dotenv: opencomplai.env
  variables:
    # Exit-code contract (opencomplai check / opencomplai-gitlab-connector):
    #   0 = pass             scan passed (or degraded_complete in local scan mode)
    #   1 = control_fail     a required control failed
    #   2 = validation_fail  manifest or input validation error
    #   3 = policy_block     prohibited system (EU AI Act Article 5)
    #   4 = trap_detected    Article 25 substantial-modification freeze
    #
    # This dashboard's own ingest endpoint — safe to commit as plain text,
    # it is not a secret. OPENCOMPLAI_API_KEY is NOT declared here — it
    # comes from the masked/protected CI/CD variable set above, which
    # GitLab injects into the job environment automatically.
    OPENCOMPLAI_DASHBOARD_URL: "https://YOUR-DASHBOARD-HOST/api/ingest"
    GL_ENV_FILE: opencomplai.env

pip install opencomplai
opencomplai check --sign
# Keyless CI: write the artifact without a signature and print a warning instead of exiting 2:
# opencomplai check --sign-if-available
CHECK_EXIT=$?

# Push the scan artifact to the dashboard via the CLI:
OPENCOMPLAI_API_KEY="$OPENCOMPLAI_API_KEY" \
OPENCOMPLAI_DASHBOARD_URL="https://YOUR-DASHBOARD-HOST/api/ingest" \
  opencomplai push

exit "$CHECK_EXIT"

opencomplai check --with-gaps --report-junit report.xml --sarif-output check.sarif --summary-md summary.md