name: "compliance: full swarm"

# Full hybrid audit: deterministic scanners + LLM-driven deep_audit checks
# (RoPA drift, AGPL §13 evaluation, IDOR/access-control reasoning, ISMS clause
# review, change-management bypass detection).
#
# Triggers:
#   - Nightly cron at 02:00 UTC
#   - workflow_dispatch (run anytime)
#   - PRs labeled `compliance:full-audit`

on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:
    inputs:
      reason:
        description: 'Why are you running this manually?'
        required: false
        default: ''
  pull_request:
    types: [labeled]

permissions:
  contents: read
  pull-requests: write
  security-events: write

concurrency:
  group: compliance-swarm-${{ github.ref }}
  cancel-in-progress: false

jobs:
  swarm:
    name: Full hybrid audit
    if: |
      github.event_name != 'pull_request'
      || github.event.label.name == 'compliance:full-audit'
    runs-on: ubuntu-latest
    timeout-minutes: 60

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - uses: erp-mafia/compliancemaxx@248cebcf90867fa813a8c0a2bc66cca70a56db3a # v2
        with:
          mode: audit                    # v2 name; was `swarm` in v1
          llm-provider: bedrock
          fail-on-findings: false        # observational while bedding in
        env:
          AWS_REGION: eu-north-1
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          # Pin the audit model explicitly rather than leaving this commented
          # out. compliancemaxx defaults to `eu.anthropic.claude-sonnet-4-6`
          # when it is unset (packages/cli/src/llm/bedrock.ts), which quietly
          # kept the nightly audit a generation behind after #1218. Keep in
          # sync with compliance-pr.yml and lib/agent/composer/client.ts.
          COMPLIANCE_BEDROCK_MODEL: eu.anthropic.claude-sonnet-5