# Vulnerability Scan and Remediation Workflow
#
# This is a thin wrapper that uses the OpenHands vulnerability-remediation action.
# It auto-updates when the action in OpenHands/extensions is updated.
#
# INSTALLATION:
#   curl -o .github/workflows/vulnerability-scan.yml \
#     https://raw.githubusercontent.com/OpenHands/extensions/main/plugins/vulnerability-remediation/workflows/vulnerability-scan.yml
#
# REQUIRED SECRETS:
#   - LLM_API_KEY: API key for your LLM provider (OpenAI, Anthropic, etc.)
#
# OPTIONAL SECRETS:
#   - PAT_TOKEN: GitHub PAT for creating PRs (uses GITHUB_TOKEN if not set)
#
# The action will:
#   1. Run a Trivy security scan
#   2. Skip agent if no vulnerabilities found (saves costs)
#   3. Create PRs for fixable vulnerabilities

name: Vulnerability Scan and Remediation

on:
    # Run weekly on Monday at 9am UTC
    schedule:
        - cron: '0 9 * * 1'

    # Allow manual trigger
    workflow_dispatch:
        inputs:
            severity_threshold:
                description: 'Minimum severity to remediate'
                required: false
                default: 'HIGH'
                type: choice
                options:
                    - CRITICAL
                    - HIGH
                    - MEDIUM
                    - LOW
            max_vulnerabilities:
                description: 'Maximum vulnerabilities to fix (0 = unlimited)'
                required: false
                default: '5'
                type: string
            llm_model:
                description: 'LLM model to use for remediation'
                required: false
                default: 'anthropic/claude-sonnet-4-5-20250929'
                type: string
            llm_base_url:
                description: 'Custom LLM base URL (optional)'
                required: false
                default: ''
                type: string

permissions:
    contents: write
    pull-requests: write
    security-events: read

jobs:
    scan-and-remediate:
        runs-on: ubuntu-latest
        timeout-minutes: 60

        steps:
            # Uses @main to auto-update when the action is improved
            - name: Run Vulnerability Remediation
              id: remediate
              uses: OpenHands/extensions/plugins/vulnerability-remediation@main
              with:
                  severity-threshold: ${{ inputs.severity_threshold || 'HIGH' }}
                  max-vulnerabilities: ${{ inputs.max_vulnerabilities || '5' }}
                  llm-model: ${{ inputs.llm_model || 'anthropic/claude-sonnet-4-5-20250929' }}
                  llm-base-url: ${{ inputs.llm_base_url || '' }}
                  llm-api-key: ${{ secrets.LLM_API_KEY }}
                  github-token: ${{ secrets.OPENHANDS_BOT_GITHUB_PAT_PUBLIC || secrets.GITHUB_TOKEN }}

            - name: Summary
              run: |
                  echo "### Vulnerability Scan Results" >> $GITHUB_STEP_SUMMARY
                  if [ "${{ steps.remediate.outputs.scan-only }}" == "true" ]; then
                    echo "✅ No vulnerabilities found that need remediation." >> $GITHUB_STEP_SUMMARY
                  else
                    echo "🔍 Found ${{ steps.remediate.outputs.vulnerabilities-found }} vulnerabilities to remediate." >> $GITHUB_STEP_SUMMARY
                  fi