Check agent readiness in CI

name: Agent readiness
on:
  schedule:
    - cron: "0 6 * * 1" # Mondays, 06:00 UTC
  workflow_dispatch:
permissions: {}
jobs:
  agent-readiness:
    runs-on: ubuntu-latest
    steps:
      - name: Check the score
        env:
          SITE: example.com
          MIN_SCORE: 60
          # Uncomment to scan again instead of reading a stored record:
          # FRESH: 1
        run: |
          # Fail the job when the agent readiness score of SITE is below MIN_SCORE.
          # Exit 0: at or above. Exit 1: below. Exit 2: not measured. Exit 3: no result.
          # Needs curl and jq. Set FRESH=1 to scan again instead of reading a stored record.
          set -euo pipefail

          for name in SITE MIN_SCORE; do
            if [ -z "${!name:-}" ]; then
              echo "$name is not set." >&2
              exit 3
            fi
          done
          if [[ ! "$MIN_SCORE" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
            echo "MIN_SCORE must be a number." >&2
            exit 3
          fi
          for tool in curl jq; do
            if ! command -v "$tool" > /dev/null; then
              echo "$tool is not installed." >&2
              exit 3
            fi
          done

          API_URL="${API_URL:-https://agenticwebscore.com/api/scan}"
          body=$(mktemp)
          headers=$(mktemp)
          trap 'rm -f "$body" "$headers"' EXIT
          query=(--data-urlencode "target=$SITE")
          if [ "${FRESH:-}" = 1 ]; then
            query+=(--data-urlencode "fresh=1")
          fi

          # A scan may run for 60 s, so curl waits for twice that.
          curl_options=(
            --silent --show-error --get
            --max-time 120
            --dump-header "$headers" --output "$body"
            --write-out "%{http_code}"
          )
          # Prints the HTTP status, or 000 when nothing answered.
          ask() {
            curl "${curl_options[@]}" "${query[@]}" "$API_URL" || true
          }

          status=$(ask)
          if [ "$status" = 429 ] || [ "$status" = 503 ]; then
            pause=$(grep -i "^retry-after:" "$headers" | cut -d: -f2 | tr -d "[:space:]" || true)
            if [[ "$pause" =~ ^[0-9]+$ ]]; then
              echo "HTTP $status. Waiting $pause s, as Retry-After says, then asking once more."
              sleep "$pause"
              status=$(ask)
            fi
          fi

          if [ "$status" != 200 ]; then
            what="answered HTTP $status"
            if [ "$status" = 000 ]; then what="did not answer"; fi
            message=$(jq -r '.message // empty' "$body" 2> /dev/null || true)
            echo "No result: the API $what. $message" >&2
            exit 3
          fi

          fields='[.score, .grade, .level, .rubricVersion, .fingerprint] | map(tostring) | join(" ")'
          read -r score grade level rubric fingerprint < <(jq -r "$fields" "$body" 2> /dev/null) || {
            echo "No result: the answer is not a scan record." >&2
            exit 3
          }
          report="${API_URL%/api/scan}/aws/$SITE"

          if [ "$score" = null ]; then
            reason=$(jq -r '.blocked.reason // "unknown"' "$body")
            detail=$(jq -r '.blocked.detail // "no detail given"' "$body")
            echo "Not measured ($reason): $detail"
            echo "A site that is not measured has no score, so it is neither above nor below $MIN_SCORE."
            echo "Report: $report"
            exit 2
          fi

          echo "Score $score, grade $grade, level L$level, rubric v$rubric, fingerprint $fingerprint."
          echo "Report: $report"
          if jq -e --arg min "$MIN_SCORE" '.score >= ($min | tonumber)' "$body" > /dev/null; then
            echo "At or above $MIN_SCORE."
          else
            echo "Below $MIN_SCORE." >&2
            exit 1
          fi

#!/usr/bin/env bash
# Fail the job when the agent readiness score of SITE is below MIN_SCORE.
# Exit 0: at or above. Exit 1: below. Exit 2: not measured. Exit 3: no result.
# Needs curl and jq. Set FRESH=1 to scan again instead of reading a stored record.
set -euo pipefail

for name in SITE MIN_SCORE; do
  if [ -z "${!name:-}" ]; then
    echo "$name is not set." >&2
    exit 3
  fi
done
if [[ ! "$MIN_SCORE" =~ ^[0-9]+([.][0-9]+)?$ ]]; then
  echo "MIN_SCORE must be a number." >&2
  exit 3
fi
for tool in curl jq; do
  if ! command -v "$tool" > /dev/null; then
    echo "$tool is not installed." >&2
    exit 3
  fi
done

API_URL="${API_URL:-https://agenticwebscore.com/api/scan}"
body=$(mktemp)
headers=$(mktemp)
trap 'rm -f "$body" "$headers"' EXIT
query=(--data-urlencode "target=$SITE")
if [ "${FRESH:-}" = 1 ]; then
  query+=(--data-urlencode "fresh=1")
fi

# A scan may run for 60 s, so curl waits for twice that.
curl_options=(
  --silent --show-error --get
  --max-time 120
  --dump-header "$headers" --output "$body"
  --write-out "%{http_code}"
)
# Prints the HTTP status, or 000 when nothing answered.
ask() {
  curl "${curl_options[@]}" "${query[@]}" "$API_URL" || true
}

status=$(ask)
if [ "$status" = 429 ] || [ "$status" = 503 ]; then
  pause=$(grep -i "^retry-after:" "$headers" | cut -d: -f2 | tr -d "[:space:]" || true)
  if [[ "$pause" =~ ^[0-9]+$ ]]; then
    echo "HTTP $status. Waiting $pause s, as Retry-After says, then asking once more."
    sleep "$pause"
    status=$(ask)
  fi
fi

if [ "$status" != 200 ]; then
  what="answered HTTP $status"
  if [ "$status" = 000 ]; then what="did not answer"; fi
  message=$(jq -r '.message // empty' "$body" 2> /dev/null || true)
  echo "No result: the API $what. $message" >&2
  exit 3
fi

fields='[.score, .grade, .level, .rubricVersion, .fingerprint] | map(tostring) | join(" ")'
read -r score grade level rubric fingerprint < <(jq -r "$fields" "$body" 2> /dev/null) || {
  echo "No result: the answer is not a scan record." >&2
  exit 3
}
report="${API_URL%/api/scan}/aws/$SITE"

if [ "$score" = null ]; then
  reason=$(jq -r '.blocked.reason // "unknown"' "$body")
  detail=$(jq -r '.blocked.detail // "no detail given"' "$body")
  echo "Not measured ($reason): $detail"
  echo "A site that is not measured has no score, so it is neither above nor below $MIN_SCORE."
  echo "Report: $report"
  exit 2
fi

echo "Score $score, grade $grade, level L$level, rubric v$rubric, fingerprint $fingerprint."
echo "Report: $report"
if jq -e --arg min "$MIN_SCORE" '.score >= ($min | tonumber)' "$body" > /dev/null; then
  echo "At or above $MIN_SCORE."
else
  echo "Below $MIN_SCORE." >&2
  exit 1
fi