phishdestroy-check.yml

name: Security Blocklist Scan

on:
  push:
  pull_request:
  schedule:
    - cron: '0 5 * * *'   # Every day at 05:00 UTC

permissions:
  contents: read

jobs:
  phishdestroy-check:
    runs-on: ubuntu-latest
    steps:

      - name: Download JSON destroylist
        run: |
          curl -sSLo list.json https://raw.githubusercontent.com/phishdestroy/destroylist/main/list.json

      - name: Extract blocklisted domains from JSON
        run: |
          jq -r '.domains[]' list.json | sort | uniq > destroylist_domains.txt

      - name: Download deployed homepage and extract referenced domains
        run: |
          curl -sS https://universalbit-dev.github.io/CityGenerator/ > deployed_site.html
          grep -oE "https?://[a-zA-Z0-9._~:/?#@!$&'()*,;=%-]+" deployed_site.html \
            | sed 's|https\?://||' | cut -d'/' -f1 | sort | uniq > referenced_domains.txt

      - name: Whitelist only your own domain and trusted CDNs
        run: |
          cat > whitelist.txt <<EOF
universalbit-dev.github.io
cdn.jsdelivr.net
github.com
# Add more trusted domains if needed
EOF
          grep -vxFf whitelist.txt referenced_domains.txt > domains_to_check.txt

      - name: Scan for blocklisted domains
        run: |
          if grep -Ff destroylist_domains.txt domains_to_check.txt > destroylist_matches.txt; then
            echo "::error ::Blocked phishing domains found in deployed site! Review below:"
            cat destroylist_matches.txt
            exit 1
          else
            echo "No blocked phishing domains found in deployed site."
          fi

      - name: Upload log artifacts (optional)
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: phishdestroy-scan-logs
          path: |
            destroylist.txt
            destroylist_domains.txt
            referenced_domains.txt
            domains_to_check.txt
            destroylist_matches.txt