Integration Patterns

const express = require('express');
const crypto = require('crypto');
const app = express();

// Middleware to verify webhook signature
function verifySignature(req, res, next) {
  const signature = req.headers['x-policycortex-signature'];
  const payload = JSON.stringify(req.body);
  const secret = process.env.WEBHOOK_SECRET;

  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');

  if (signature !== `sha256=${expectedSignature}`) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  next();
}

// Handle policy violation events
app.post('/webhooks/violations', express.json(), verifySignature, async (req, res) => {
  const { type, data } = req.body;

  switch (type) {
    case 'policy.violation.created':
      await handleNewViolation(data.violation);
      break;

    case 'policy.violation.resolved':
      await handleResolvedViolation(data.violation);
      break;

    case 'compliance.status.changed':
      await updateComplianceDashboard(data.compliance);
      break;
  }

  res.status(200).json({ received: true });
});

async function handleNewViolation(violation) {
  // Create JIRA ticket for high/critical violations
  if (['HIGH', 'CRITICAL'].includes(violation.severity)) {
    await createJiraTicket({
      summary: `Policy Violation: ${violation.policy_name}`,
      description: `Resource: ${violation.resource_id}\nMessage: ${violation.message}`,
      priority: violation.severity === 'CRITICAL' ? 'Highest' : 'High',
      assignee: getResourceOwner(violation.resource_id)
    });
  }

  // Send Slack notification
  await sendSlackAlert({
    channel: '#security-alerts',
    text: `🚨 New ${violation.severity} violation detected`,
    blocks: [
      {
        type: 'section',
        text: {
          type: 'mrkdwn',
          text: `*Policy:* ${violation.policy_name}\n*Resource:* ${violation.resource_id}\n*Message:* ${violation.message}`
        }
      }
    ]
  });
}

{
  "Rules": [
    {
      "Name": "PolicyViolationRule",
      "EventPattern": {
        "source": ["policycortex"],
        "detail-type": ["Policy Violation"],
        "detail": {
          "severity": ["HIGH", "CRITICAL"],
          "resource_type": ["AWS::S3::Bucket", "AWS::EC2::SecurityGroup"]
        }
      },
      "Targets": [
        {
          "Id": "SecurityLambda",
          "Arn": "arn:aws:lambda:us-east-1:123456789012:function:HandleSecurityViolation"
        },
        {
          "Id": "NotificationSNS",
          "Arn": "arn:aws:sns:us-east-1:123456789012:security-alerts"
        }
      ]
    },
    {
      "Name": "ComplianceStatusRule",
      "EventPattern": {
        "source": ["policycortex"],
        "detail-type": ["Compliance Status Change"],
        "detail": {
          "framework": ["SOC2", "HIPAA"],
          "status": ["NON_COMPLIANT"]
        }
      },
      "Targets": [
        {
          "Id": "ComplianceTeamSNS",
          "Arn": "arn:aws:sns:us-east-1:123456789012:compliance-alerts"
        }
      ]
    }
  ]
}

name: Infrastructure Policy Gate

on:
  pull_request:
    paths:
      - 'infrastructure/**'
      - 'terraform/**'

jobs:
  policy-gate:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3

      # Install PolicyCortex CLI
      - name: Setup PolicyCortex
        run: |
          curl -fsSL https://cli.policycortex.com/install.sh | sh
          echo "$HOME/.policycortex/bin" >> $GITHUB_PATH

      # Run pre-deployment policy scan
      - name: Policy Validation Gate
        id: policy-scan
        run: |
          # Scan infrastructure changes
          policycortex scan infrastructure \
            --path ./infrastructure \
            --frameworks soc2,hipaa \
            --output json > scan-results.json

          # Check for gate-breaking violations
          CRITICAL_COUNT=$(jq '.violations[] | select(.severity=="CRITICAL") | length' scan-results.json)
          HIGH_COUNT=$(jq '.violations[] | select(.severity=="HIGH") | length' scan-results.json)

          # Fail if critical violations or too many high violations
          if [ "$CRITICAL_COUNT" -gt 0 ] || [ "$HIGH_COUNT" -gt 3 ]; then
            echo "Policy gate failed: $CRITICAL_COUNT critical, $HIGH_COUNT high violations"
            echo "gate_status=failed" >> $GITHUB_OUTPUT
            exit 1
          else
            echo "Policy gate passed"
            echo "gate_status=passed" >> $GITHUB_OUTPUT
          fi

      # Comment on PR with results
      - name: Policy Results Comment
        uses: actions/github-script@v6
        if: always()
        with:
          script: |
            const fs = require('fs');
            const results = JSON.parse(fs.readFileSync('scan-results.json', 'utf8'));
            const gateStatus = process.env.GATE_STATUS;

            const violations = results.violations || [];
            const critical = violations.filter(v => v.severity === 'CRITICAL').length;
            const high = violations.filter(v => v.severity === 'HIGH').length;
            const medium = violations.filter(v => v.severity === 'MEDIUM').length;

            const statusEmoji = gateStatus === 'passed' ? '✅' : '❌';
            const comment = `
            ## ${statusEmoji} Policy Validation Results

            **Gate Status:** ${gateStatus === 'passed' ? 'PASSED' : 'FAILED'}

            | Severity | Count |
            |----------|-------|
            | Critical | ${critical} |
            | High     | ${high} |
            | Medium   | ${medium} |

            ${gateStatus === 'failed' ? '❌ **Deployment blocked** - Please resolve critical violations before merging.' : '✅ **Ready to deploy** - All policy checks passed.'}
            `;

            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: comment
            });

# Multi-stage policy enforcement
stages:
  - stage: "development"
    policy_enforcement: "warn_only"
    frameworks: ["basic_security"]

  - stage: "staging"
    policy_enforcement: "block_high"
    frameworks: ["soc2", "security_baseline"]

  - stage: "production"
    policy_enforcement: "block_medium"
    frameworks: ["soc2", "hipaa", "pci_dss"]

# Deployment pipeline with policy checkpoints
deployment:
  dev_deployment:
    before_deploy:
      - policy_scan:
          severity_threshold: "none"
          action: "warn"

  staging_deployment:
    before_deploy:
      - policy_scan:
          severity_threshold: "high"
          action: "block"
      - compliance_check:
          frameworks: ["soc2"]
          min_score: 75

  prod_deployment:
    before_deploy:
      - policy_scan:
          severity_threshold: "medium"
          action: "block"
      - compliance_check:
          frameworks: ["soc2", "hipaa"]
          min_score: 90
      - manual_approval:
          required: true
          approvers: ["security_team", "compliance_team"]