Patch

name: "Grok Lingxi Hardening & CBE Pipeline"

on:
  push:
    branches: [ "main", "develop" ]
  pull_request:
    branches: [ "main" ]
  schedule:
    - cron: '0 0 * * 1'

permissions:
  contents: write
  pull-requests: write
  security-events: write

jobs:
  agentic-hardening-scan:
    name: "Lingxi Multi-Agent AI Audit"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - uses: actions/setup-node@v4
        with:
          node-version: "20"
      - name: Install audit tools
        run: |
          python -m pip install --upgrade pip
          pip install semgrep requests
          if [ -f package.json ]; then npm ci; fi
      - name: Agent 4 red-team fuzzer
        continue-on-error: true
        run: |
          mkdir -p .grok_security_state/share
          python .github/scripts/agent4_redteam_fuzzer.py
      - name: Agent 5 patch engine
        run: python .github/scripts/agent5_patch_engine.py