pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh 'pip install sanicode'
                sh 'sanicode scan . --fail-on high --format sarif --quiet'
            }
            post {
                always {
                    archiveArtifacts artifacts: 'sanicode-output/report.sarif'
                }
            }
        }
    }
}
