Pentest after a deployment

import Antigen, { tCell } from "@antigen/sdk";
import { mkdir, writeFile } from "node:fs/promises";

async function main() {
  const apiKey = process.env.ANTIGEN_API_KEY;
  const target = process.env.PENTEST_TARGET;

  if (!apiKey || !target) {
    throw new Error(
      "Set ANTIGEN_API_KEY and PENTEST_TARGET before running.",
    );
  }

  const antigen = new Antigen(apiKey);
  const approved = await antigen.getApprovedTargets();

  if (!approved.includes(target)) {
    throw new Error(`${target} is not approved for testing.`);
  }

  const original = await antigen.agents.get(tCell);

  const agent = antigen.agent({
    ...original,
    skills: [
      ...original.skills,
      `
        Investigate authorization across accounts.
        Check whether one account can read or modify
        resources belonging to another account.
      `,
    ],
    guardrails: [
      original.guardrails,
      "Do not attempt denial of service or delete customer data.",
    ].join("\n"),
  });

  await mkdir("pentest-results", { recursive: true });

  const run = await agent.run({
    instructions: "Test the production application for vulnerabilities.",
    targets: [target],
  });

  console.log(`Started run ${run.id}`);

  await writeFile(
    "pentest-results/run.json",
    JSON.stringify(
      {
        runId: run.id,
        target,
        deploymentSha: process.env.DEPLOYMENT_SHA,
      },
      null,
      2,
    ),
  );

  for await (const event of run) {
    console.log(`${event.type}: ${event.summary}`);
  }

  await run.wait();

  const vulnerabilities = await run.vulnerabilities.list();

  await writeFile(
    "pentest-results/vulnerabilities.json",
    JSON.stringify(vulnerabilities, null, 2),
  );

  const critical = vulnerabilities.filter(
    (vulnerability) => vulnerability.severity === "critical",
  );

  if (critical.length > 0) {
    console.error(`Found ${critical.length} critical vulnerabilities.`);
    process.exitCode = 1;
    return;
  }

  console.log("Pentest completed without critical vulnerabilities.");
}

main().catch((error) => {
  console.error(error instanceof Error ? error.message : error);
  process.exitCode = 2;
});

name: Production pentest

on:
  deployment_status:

permissions:
  contents: read
  actions: read

jobs:
  pentest:
    name: Pentest production
    if: >-
      github.event.deployment_status.state == 'success' &&
      github.event.deployment.environment == 'production'
    runs-on: ubuntu-latest
    timeout-minutes: 350

    concurrency:
      group: antigen-production-pentest
      cancel-in-progress: false

    steps:
      - name: Check the last pentest attempt
        id: cooldown
        uses: actions/github-script@v9
        with:
          script: |
            const cutoff = Date.now() - 24 * 60 * 60 * 1000;

            const { data: current } =
              await github.rest.actions.getWorkflowRun({
                ...context.repo,
                run_id: context.runId,
              });

            const runs = await github.paginate(
              github.rest.actions.listWorkflowRuns,
              {
                ...context.repo,
                workflow_id: current.workflow_id,
                per_page: 100,
              },
            );

            for (const run of runs) {
              if (
                run.status === "completed" &&
                Date.parse(run.updated_at) < cutoff
              ) {
                continue;
              }

              const jobs = await github.paginate(
                github.rest.actions.listJobsForWorkflowRun,
                {
                  ...context.repo,
                  run_id: run.id,
                  filter: "all",
                  per_page: 100,
                },
              );

              const recentAttempt = jobs.some((job) =>
                job.name === "Pentest production" &&
                job.steps?.some((step) =>
                  step.name === "Run pentest" &&
                  step.status !== "queued" &&
                  step.conclusion !== "skipped" &&
                  step.started_at &&
                  Date.parse(step.started_at) >= cutoff
                )
              );

              if (recentAttempt) {
                core.info(
                  "Skipping: a pentest was attempted in the last 24 hours."
                );
                return false;
              }
            }

            return true;

      - uses: actions/checkout@v7
        if: steps.cooldown.outputs.result == 'true'
        with:
          ref: ${{ github.event.repository.default_branch }}

      - uses: actions/setup-node@v7
        if: steps.cooldown.outputs.result == 'true'
        with:
          node-version: 24
          cache: npm

      - name: Install dependencies
        if: steps.cooldown.outputs.result == 'true'
        run: npm ci

      - name: Run pentest
        if: steps.cooldown.outputs.result == 'true'
        env:
          ANTIGEN_API_KEY: ${{ secrets.ANTIGEN_API_KEY }}
          PENTEST_TARGET: ${{ vars.PENTEST_TARGET }}
          DEPLOYMENT_SHA: ${{ github.event.deployment.sha }}
        run: npx --no-install tsx scripts/pentest.ts

      - name: Save results
        if: always() && steps.cooldown.outputs.result == 'true'
        uses: actions/upload-artifact@v7
        with:
          name: pentest-results-${{ github.run_id }}-${{ github.run_attempt }}
          path: pentest-results/
          if-no-files-found: ignore