vulnerability-scan.yml

# SPDX-FileCopyrightText: 2023 Technology Innovation Institute (TII)
#
# SPDX-License-Identifier: Apache-2.0

name: Ghaf Vulnerability Scan

on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scheduled:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
    - name: Harden the runner (Audit all outbound calls)
      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
      with:
        egress-policy: audit

    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
    - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
      with:
        nix_path: nixpkgs=channel:nixpkgs-unstable
        extra_nix_config: |
          trusted-public-keys = ghaf-dev.cachix.org-1:S3M8x3no8LFQPBfHw1jl6nmP8A7cVWKntoMKN3IsEQY= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
          substituters = https://ghaf-dev.cachix.org https://cache.nixos.org
          connect-timeout = 5
          system-features = nixos-test benchmark big-parallel kvm
    - name: Grype DB update
      run: |
        nix develop --command grype --version
        nix develop --command grype db update
        nix develop --command grype db status
    - name: Ghaf Vulnerability Scan (main)
      run: |
        nix run .#ghafscan -- --verbose=2 --whitelist=manual_analysis.csv --outdir=reports/main --flakeref=github:tiiuae/ghaf?ref=main --target=packages.x86_64-linux.lenovo-x1-carbon-gen11-debug --target=packages.aarch64-linux.nvidia-jetson-orin-nx-debug --target=packages.x86_64-linux.system76-darp11-b-debug
    - uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 # v6.0.1
      with:
        commit_message: Automatic vulnerability report update
        file_pattern: 'reports/*'