Initial commit: Compliance Scanner Agent

Autonomous security and compliance scanning agent for git repositories.
Features: SAST (Semgrep), SBOM (Syft), CVE monitoring (OSV.dev/NVD),
GDPR/OAuth pattern detection, LLM triage, issue creation (GitHub/GitLab/Jira),
PR reviews, and Dioxus fullstack dashboard.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

compliance-agent/src/webhooks/github.rs

@@ -0,0 +1,130 @@
+use std::sync::Arc;
+
+use axum::body::Bytes;
+use axum::extract::Extension;
+use axum::http::{HeaderMap, StatusCode};
+use hmac::{Hmac, Mac};
+use secrecy::ExposeSecret;
+use sha2::Sha256;
+
+use compliance_core::models::ScanTrigger;
+
+use crate::agent::ComplianceAgent;
+
+type HmacSha256 = Hmac<Sha256>;
+
+pub async fn handle_github_webhook(
+    Extension(agent): Extension<Arc<ComplianceAgent>>,
+    headers: HeaderMap,
+    body: Bytes,
+) -> StatusCode {
+    // Verify HMAC signature
+    if let Some(secret) = &agent.config.github_webhook_secret {
+        let signature = headers
+            .get("x-hub-signature-256")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("");
+
+        if !verify_signature(secret.expose_secret(), &body, signature) {
+            tracing::warn!("GitHub webhook: invalid signature");
+            return StatusCode::UNAUTHORIZED;
+        }
+    }
+
+    let event = headers
+        .get("x-github-event")
+        .and_then(|v| v.to_str().ok())
+        .unwrap_or("");
+
+    let payload: serde_json::Value = match serde_json::from_slice(&body) {
+        Ok(v) => v,
+        Err(e) => {
+            tracing::warn!("GitHub webhook: invalid JSON: {e}");
+            return StatusCode::BAD_REQUEST;
+        }
+    };
+
+    match event {
+        "push" => handle_push(agent, &payload).await,
+        "pull_request" => handle_pull_request(agent, &payload).await,
+        _ => {
+            tracing::debug!("GitHub webhook: ignoring event '{event}'");
+            StatusCode::OK
+        }
+    }
+}
+
+async fn handle_push(agent: Arc<ComplianceAgent>, payload: &serde_json::Value) -> StatusCode {
+    let repo_url = payload["repository"]["clone_url"]
+        .as_str()
+        .or_else(|| payload["repository"]["html_url"].as_str())
+        .unwrap_or("");
+
+    if repo_url.is_empty() {
+        return StatusCode::BAD_REQUEST;
+    }
+
+    // Find matching tracked repository
+    let repo = agent
+        .db
+        .repositories()
+        .find_one(mongodb::bson::doc! { "git_url": repo_url })
+        .await
+        .ok()
+        .flatten();
+
+    if let Some(repo) = repo {
+        let repo_id = repo.id.map(|id| id.to_hex()).unwrap_or_default();
+        let agent_clone = (*agent).clone();
+        tokio::spawn(async move {
+            tracing::info!("GitHub push webhook: triggering scan for {repo_id}");
+            if let Err(e) = agent_clone.run_scan(&repo_id, ScanTrigger::Webhook).await {
+                tracing::error!("Webhook-triggered scan failed: {e}");
+            }
+        });
+    } else {
+        tracing::debug!("GitHub push webhook: no tracked repo for {repo_url}");
+    }
+
+    StatusCode::OK
+}
+
+async fn handle_pull_request(
+    _agent: Arc<ComplianceAgent>,
+    payload: &serde_json::Value,
+) -> StatusCode {
+    let action = payload["action"].as_str().unwrap_or("");
+    if action != "opened" && action != "synchronize" {
+        return StatusCode::OK;
+    }
+
+    let repo_url = payload["repository"]["clone_url"]
+        .as_str()
+        .unwrap_or("");
+    let pr_number = payload["pull_request"]["number"].as_u64().unwrap_or(0);
+
+    if repo_url.is_empty() || pr_number == 0 {
+        return StatusCode::BAD_REQUEST;
+    }
+
+    tracing::info!("GitHub PR webhook: PR #{pr_number} {action} on {repo_url}");
+    // PR review scan would be triggered here - runs incremental SAST on diff
+    // and posts review comments via the GitHub tracker
+
+    StatusCode::OK
+}
+
+fn verify_signature(secret: &str, body: &[u8], signature: &str) -> bool {
+    let sig = signature.strip_prefix("sha256=").unwrap_or(signature);
+    let sig_bytes = match hex::decode(sig) {
+        Ok(b) => b,
+        Err(_) => return false,
+    };
+
+    let mut mac = match HmacSha256::new_from_slice(secret.as_bytes()) {
+        Ok(m) => m,
+        Err(_) => return false,
+    };
+    mac.update(body);
+    mac.verify_slice(&sig_bytes).is_ok()
+}