# Kuality Quality Gate — GitLab CI Template
#
# Variables (Settings → CI/CD → Variables):
#   KUALITY_API_KEY    — your Kuality API key (masked, from Organization → API Keys)
#   STAGING_URL        — e.g. https://staging.yoursite.com
#   SCAN_TYPES         — scan type to run (default: web)
#   SCORE_THRESHOLD    — minimum score to pass gate (default: 70)

stages:
  - quality

kuality-scan:
  stage: quality
  image: golang:alpine
  before_script:
    - apk add --no-cache curl tar
    - |
      ARCH=$(uname -m)
      case "$ARCH" in
        x86_64)  ARCH="amd64" ;;
        aarch64) ARCH="arm64" ;;
      esac
      curl -fsSL "https://github.com/kuality-io/cli/releases/latest/download/kuality_latest_linux_${ARCH}.tar.gz" -o kuality.tar.gz || \
      curl -fsSL "https://github.com/kuality-io/cli/releases/latest/download/kuality_$(curl -sf https://api.github.com/repos/kuality-io/cli/releases/latest | grep tag_name | cut -d'"' -f4 | sed 's/^v//')_linux_${ARCH}.tar.gz" -o kuality.tar.gz
      tar xzf kuality.tar.gz
      mv kuality /usr/local/bin/
  script:
    - >
      kuality scan "${STAGING_URL}"
      --type "${SCAN_TYPES:-web}"
      --fail-on high
      --format junit > kuality-report.xml
  artifacts:
    when: always
    reports:
      junit: kuality-report.xml
    expire_in: 30 days
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
