#!/usr/bin/env bash
set -euo pipefail
: "${SCANTELIO_API_URL:?Set the API URL}"
: "${SCANTELIO_TOKEN:?Store the token in CI secrets}"
: "${SCANTELIO_PROJECT:?Set the verified project ID}"
: "${SCANTELIO_ENVIRONMENT:?Set the staging environment ID}"
: "${SCANTELIO_DEPLOYMENT:?Set the authorized staging URL}"
: "${SCANTELIO_REVISION:?Set the tested commit or release ID}"
: "${SCANTELIO_IDEMPOTENCY_KEY:?Set a stable unique key for this pipeline attempt}"
# Download scantelio.mjs from your trusted Scantelio installation; pin its checksum.
# Do not enable shell tracing: the token must never be printed.
node scantelio.mjs --project "$SCANTELIO_PROJECT" \
  --environment "$SCANTELIO_ENVIRONMENT" --deployment "$SCANTELIO_DEPLOYMENT" \
  --revision "$SCANTELIO_REVISION" --report scantelio-report.json
# 0 = gate passed, 1 = blocking findings, 2 = incomplete/error.
# CI cancellation does not automatically cancel a server-side run.