Enterprise-grade compliance automation

# Download and install the Certus CLI
curl -sSL https://downloads.certus.ai/cli/install.sh | bash

# Verify installation
certus --version

# Initialize your workspace
certus init --org your-org-name

# Authenticate with your service token
certus auth login

# Run your first verification
certus verify --local

# Example workflow sequence
1. PR opened → Webhook received
2. Blueprint compiled → DAG generated
3. Lanes spawned → Parallel execution
   ├── Dev: Unit tests, linting, type checking
   ├── QA: Integration tests, E2E, coverage
   ├── SecOps: SAST, SBOM, IaC policy, secrets scan
   └── Audit: Evidence collection, live monitoring
4. Evidence signed → KMS attestation
5. Results aggregated → Framework mapping
6. Distribution → GRC platforms, SIEM, webhooks
7. PR status updated → Merge decision

name: Certus Verification
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  certus-verify:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for diff analysis

      - name: Install Certus CLI
        run: |
          curl -sSL https://downloads.certus.ai/cli/install.sh | bash
          certus --version

      - name: Run Certus Verification
        env:
          CERTUS_TOKEN: ${{ secrets.CERTUS_TOKEN }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          certus verify \
            --pr ${{ github.event.pull_request.number }} \
            --repo ${{ github.repository }} \
            --commit ${{ github.event.pull_request.head.sha }} \
            --format json \
            --output evidence/bundle.json

      - name: Upload Evidence Bundle
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: certus-evidence
          path: evidence/
          retention-days: 90

# Add Certus Helm repository
helm repo add certus https://charts.certus.ai
helm repo update

# Create namespace
kubectl create namespace certus-system

# Install CRDs
kubectl apply -f https://downloads.certus.ai/k8s/crds.yaml

# Create secrets for API tokens and KMS
kubectl create secret generic certus-config \
  --from-literal=api-token=${CERTUS_API_TOKEN} \
  --from-literal=kms-key-id=${AWS_KMS_KEY_ID} \
  --from-literal=kms-region=us-east-1 \
  -n certus-system

# Install Certus with custom values
helm install certus certus/certus-agent \
  --namespace certus-system \
  --values values.yaml \
  --wait

# .gitlab-ci.yml
certus-verify:
  stage: test
  image: ubuntu:22.04

  variables:
    CERTUS_VERSION: "2.4.1"

  before_script:
    - apt-get update && apt-get install -y curl
    - curl -sSL https://downloads.certus.ai/cli/install.sh | bash

  script:
    - |
      certus verify \
        --mr ${CI_MERGE_REQUEST_IID} \
        --project ${CI_PROJECT_PATH} \
        --commit ${CI_COMMIT_SHA} \
        --gitlab

  artifacts:
    reports:
      certus: evidence/report.json
    paths:
      - evidence/
    expire_in: 90 days

  only:
    - merge_requests

pipeline {
    agent any

    environment {
        CERTUS_TOKEN = credentials('certus-api-token')
    }

    stages {
        stage('Setup') {
            steps {
                sh 'curl -sSL https://downloads.certus.ai/cli/install.sh | bash'
            }
        }

        stage('Certus Verification') {
            steps {
                sh """
                    certus verify \
                        --commit ${GIT_COMMIT} \
                        --branch ${BRANCH_NAME} \
                        --output evidence/bundle.json
                """
            }
        }

        stage('Archive Evidence') {
            steps {
                archiveArtifacts artifacts: 'evidence/**', fingerprint: true
            }
        }
    }

    post {
        always {
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: 'evidence',
                reportFiles: 'report.html',
                reportName: 'Certus Evidence Report'
            ])
        }
    }
}

# .certus.yml
version: 2

# Workspace configuration
workspace:
  name: api-service
  tier: production  # production, staging, development

# Verification settings
verify:
  parallel: 6
  timeout: 600
  fail_on:
    - critical_vulnerabilities
    - missing_tests
    - policy_violations

# Scanner configuration
scanners:
  sast:
    enabled: true
    tools:
      - semgrep
      - snyk
    severity_threshold: medium

  sbom:
    enabled: true
    format: spdx
    include_dev_dependencies: false

  iac:
    enabled: true
    tools:
      - tfsec
      - checkov
    scan_paths:
      - terraform/
      - .github/workflows/

  secrets:
    enabled: true
    tools:
      - gitleaks
      - trufflehog

# Evidence configuration
evidence:
  formats:
    - json
    - pdf
  retention_days: 2555  # 7 years
  sign: true
  attestations:
    - slsa_provenance
    - sbom
    - test_results

# Export destinations
exports:
  - type: vanta
    enabled: true
    sync_interval: 300

  - type: slack
    enabled: true
    channel: "#compliance-alerts"
    webhook_url_secret: SLACK_WEBHOOK_URL

  - type: s3
    enabled: true
    bucket: compliance-evidence
    prefix: certus/

# Notifications
notifications:
  on_failure:
    - slack
    - pagerduty
  on_success:
    - slack

# Custom metadata
metadata:
  owner: platform-team
  cost_center: engineering
  data_classification: internal

# Authentication header
curl -H "Authorization: Bearer ${CERTUS_TOKEN}" \
     https://api.certus.ai/v1/workspaces

# Response
HTTP/1.1 200 OK
Content-Type: application/json

{
  "workspaces": [
    {
      "id": "ws_abc123",
      "name": "acme-engineering",
      "created_at": "2024-01-15T10:30:00Z"
    }
  ]
}

# Query verification with nested evidence
query GetVerification($id: ID!) {
  verification(id: $id) {
    id
    status
    result
    repository {
      owner
      name
    }
    pullRequest {
      number
      title
      author
    }
    checks {
      name
      status
      duration
      findings {
        severity
        message
        location
      }
    }
    evidenceBundle {
      id
      formats
      signed
      signatureVerified
      frameworkMappings {
        framework
        controls
      }
    }
  }
}

# Subscribe to verification updates
subscription VerificationUpdates($repo: String!) {
  verificationUpdated(repository: $repo) {
    id
    status
    result
    timestamp
  }
}

// Webhook payload structure
{
  "event": "verification.completed",
  "timestamp": "2024-11-14T15:26:32Z",
  "workspace_id": "ws_abc123",
  "data": {
    "verification_id": "ver_xyz789",
    "repository": "acme/api-service",
    "pr_number": 456,
    "status": "completed",
    "result": "passed",
    "evidence_bundle_id": "bundle_abc123",
    "framework_mappings": {
      "soc2": ["CC-1.2", "CC-7.1", "CC-8.1"],
      "iso27001": ["A.9.2.1", "A.12.6.1"]
    }
  },
  "signature": "sha256=a1b2c3d4..."
}

import hmac
import hashlib

def verify_webhook(payload, signature, secret):
    expected = hmac.new(
        secret.encode(),
        payload.encode(),
        hashlib.sha256
    ).hexdigest()

    return hmac.compare_digest(f"sha256={expected}", signature)

# Enable debug logging
export CERTUS_LOG_LEVEL=debug

# Run verification with debug output
certus verify --pr 123 --debug

# View historical logs
certus logs --verification-id ver_xyz789 --format json

# Stream live logs (for long-running verifications)
certus logs --follow --verification-id ver_xyz789

# Check CLI version and installation
certus --version
certus doctor

# Test API connectivity
certus ping

# Verify workspace configuration
certus config show

# Validate .certus.yml syntax
certus config validate

# Export diagnostic bundle (safe to share with support)
certus diagnostics export --output diagnostics.zip