# CI/CD Integration

[日本語](./INTEGRATION.ja.md)

## GitHub Actions

Create `.github/workflows/cc-audit.yml`:

```yaml
name: cc-audit Security Scan

on:
  push:
    branches: [main]
    paths:
      - '.claude/**'
      - 'mcp.json'
      - 'package.json'
      - 'Cargo.toml'
  pull_request:
    paths:
      - '.claude/**'
      - 'mcp.json'

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install cc-audit
        run: cargo install cc-audit

      - name: Scan Skills
        run: cc-audit --type skill --ci --format sarif .claude/skills/ > skills.sarif
        continue-on-error: true

      - name: Scan MCP Configuration
        run: cc-audit --type mcp --ci mcp.json
        continue-on-error: true

      - name: Scan Dependencies
        run: cc-audit --type dependency --ci ./

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: skills.sarif
        if: always()
```

## GitLab CI

```yaml
cc-audit:
  stage: security
  image: rust:latest
  before_script:
    - cargo install cc-audit
  script:
    - cc-audit --type skill --ci .claude/
    - cc-audit --type mcp --ci mcp.json
    - cc-audit --type dependency --ci ./
  allow_failure: false
```

## Pre-commit Hook

```bash
# Install hook in your project
cc-audit --init-hook .

# Remove hook
cc-audit --remove-hook .
```

The pre-commit hook automatically scans staged files before each commit.

---

# Troubleshooting

## Common Issues

### "No files found to scan"

```bash
# Check if the path exists and contains scannable files
ls -la ./my-skill/

# Use recursive mode for nested directories
cc-audit --recursive ./my-skill/
```

### "Permission denied"

```bash
# Ensure read permissions on target files
chmod -R +r ./my-skill/
```

### High false positive rate

```bash
# Increase minimum confidence level
cc-audit --min-confidence firm ./my-skill/

# Or use certain for highest precision
cc-audit --min-confidence certain ./my-skill/

# Skip comment lines
cc-audit --skip-comments ./my-skill/
```

### Scan is too slow

```bash
# Tests are excluded by default
cc-audit ./my-skill/

# Explicitly include if needed
cc-audit --include-tests ./my-skill/
```

### Custom rules not loading

```bash
# Validate YAML syntax
cat ./my-rules.yaml | python -c "import yaml, sys; yaml.safe_load(sys.stdin)"

# Required fields: id, name, severity, category, patterns, message, recommendation
```

---

# FAQ

**Q: Does cc-audit send any data externally?**

A: No. cc-audit runs entirely locally. No data is transmitted to external servers.

**Q: Can I use cc-audit in air-gapped environments?**

A: Yes. Once installed, cc-audit works completely offline.

**Q: How do I suppress specific rules?**

A: Add rule IDs to `disabled_rules` in `.cc-audit.yaml`:

```yaml
disabled_rules:
  - "PE-001"
  - "EX-002"
```

**Q: Does cc-audit scan binary files?**

A: No. Only text-based files (scripts, configs, markdown, JSON, YAML, etc.).

**Q: Can I scan remote repositories directly?**

A: Not yet. Clone first, then scan locally. Remote scanning is planned for v1.0.0.

**Q: What's the difference between `--strict` and default mode?**

A: Default mode only reports critical and high severity. `--strict` includes medium and low.

**Q: How often is the malware signature database updated?**

A: With each release. Supplement with `--malware-db` for custom signatures.

**Q: Can I contribute new detection rules?**

A: Yes! See [Contributing Guide](../CONTRIBUTING.md).
