vulnerability-scan.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "Security vulnerability scan"

on:
  workflow_dispatch:
  schedule:
    - cron: "50 1 * * *"

permissions:
  contents: read

jobs:
  latest:
    # Only run the scheduled job in hyperledger/fabric repository, not on personal forks
    if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'hyperledger/fabric')
    runs-on: ${{ github.repository == 'hyperledger/fabric' && 'fabric-ubuntu-22.04' || 'ubuntu-22.04' }}
    strategy:
      fail-fast: false
      matrix:
        ref:
          - main
          - release-2.5
    steps:
      - name: Checkout ${{ matrix.ref }} branch
        uses: actions/checkout@v4
        with:
          ref: ${{ matrix.ref }}
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Scan
        run: go run github.com/google/osv-scanner/cmd/osv-scanner@b37c83e19af3b2555864457cbd0b08ef0e1f9d7d scan --lockfile=go.mod || (( $? > 1 && $? < 127 ))

  release:
    # Only run the scheduled job in hyperledger/fabric repository, not on personal forks
    if: github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository == 'hyperledger/fabric')
    runs-on: ${{ github.repository == 'hyperledger/fabric' && 'fabric-ubuntu-22.04' || 'ubuntu-22.04' }}
    strategy:
      fail-fast: false
      matrix:
        ref:
          - main
          - release-2.5
    steps:
      - name: Checkout ${{ matrix.ref }} branch
        uses: actions/checkout@v4
        with:
          ref: ${{ matrix.ref }}
          fetch-depth: 0
      - name: Get latest release tag
        id: latest-release
        run: echo "tag=$(git -c versionsort.suffix=- tag --merged HEAD --sort=-version:refname | head -1)" >> "${GITHUB_OUTPUT}"
      - name: Checkout ${{ steps.latest-release.outputs.tag }}
        uses: actions/checkout@v4
        with:
          ref: ${{ steps.latest-release.outputs.tag }}
      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - name: Scan
        run: go run github.com/google/osv-scanner/cmd/osv-scanner@b37c83e19af3b2555864457cbd0b08ef0e1f9d7d scan --lockfile=go.mod || (( $? > 1 && $? < 127 ))