ptt-light-scan.yml

name: Pentest-Tools.com CLI Light Scan

on:
    # Runs on pushes targeting the default branch
    push:
      branches: ['main']

    # Allows you to run this workflow manually from the Actions tab
    workflow_dispatch:
      inputs:
        url:
          type: string
          description: The URL to scan
          required: true

# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
permissions:
  contents: read
  pages: write
  id-token: write

# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
concurrency:
  group: 'pages'
  cancel-in-progress: false

jobs:
  test_light_scan:
    runs-on: ubuntu-latest
    name: Run a light scan, no API key needed
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Actual PTT light test
        uses: pentesttoolscom/pentesttools-github-action@master
        id: ptt
        with:
          target: ${{ steps.deployment.outputs.page_url || 'https://resurse.dev' }}
          format: text
          fail: medium
      - name: Check the light output
        run: echo "The light report ${{ steps.ptt.outputs.result }}"
  test_deep_scan:
    runs-on: ubuntu-latest
    name: Run a manual deep scan. You will need a suitable API key
    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Actual PTT deep test
        uses: pentesttoolscom/pentesttools-github-action@master
        id: ptt
        with:
          target: ${{ inputs.url || 'https://resurse.dev' }}
          format: text
          fail: medium
          type: deep
          key: ${{ secrets.PTT_API_KEY }}
      - name: Check the deep output
        run: echo "The deep report ${{ steps.ptt.outputs.result }}"