name: "Scan dependencies"
description: "Scan dependencies"
inputs:
  build_datetime:
    description: "Build datetime, set by the CI/CD pipeline workflow"
    required: true
  build_timestamp:
    description: "Build timestamp, set by the CI/CD pipeline workflow"
    required: true
  idp_aws_report_upload_account_id:
    description: "IDP AWS report upload account ID to upload the report to"
    required: false
  idp_aws_report_upload_region:
    description: "IDP AWS report upload account region to upload the report to"
    required: false
  idp_aws_report_upload_role_name:
    description: "IDP AWS report upload role name for OIDC authentication"
    required: false
  idp_aws_report_upload_bucket_endpoint:
    description: "IDP AWS report upload endpoint to upload the report to"
    required: false
runs:
  using: "composite"
  steps:
    - name: "Generate SBOM"
      shell: bash
      run: |
        export BUILD_DATETIME=${{ inputs.build_datetime }}
        ./scripts/reports/create-sbom-report.sh
    - name: "Compress SBOM report"
      shell: bash
      run: zip sbom-repository-report.json.zip sbom-repository-report.json
    - name: "Upload SBOM report as an artefact"
      if: ${{ !env.ACT }}
      uses: actions/upload-artifact@v3
      with:
        name: sbom-repository-report.json.zip
        path: ./sbom-repository-report.json.zip
        retention-days: 21
    - name: "Scan vulnerabilities"
      shell: bash
      run: |
        export BUILD_DATETIME=${{ inputs.build_datetime }}
        ./scripts/reports/scan-vulnerabilities.sh
    - name: "Compress vulnerabilities report"
      shell: bash
      run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
    - name: "Upload vulnerabilities report as an artefact"
      if: ${{ !env.ACT }}
      uses: actions/upload-artifact@v3
      with:
        name: vulnerabilities-repository-report.json.zip
        path: ./vulnerabilities-repository-report.json.zip
        retention-days: 21
    - name: "Check prerequisites for sending the reports"
      shell: bash
      id: check
      run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
    - name: "Authenticate to send the reports"
      if: steps.check.outputs.secrets_exist == 'true'
      uses: aws-actions/configure-aws-credentials@v2
      with:
        role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
        aws-region: ${{ inputs.idp_aws_report_upload_region }}
    - name: "Send the SBOM and vulnerabilities reports to the central location"
      shell: bash
      if: steps.check.outputs.secrets_exist == 'true'
      run: |
        aws s3 cp \
          ./sbom-repository-report.json.zip \
          ${{ inputs.idp_aws_report_upload_bucket_endpoint }}/${{ inputs.build_timestamp }}-sbom-repository-report.json.zip
        aws s3 cp \
          ./vulnerabilities-repository-report.json.zip \
          ${{ inputs.idp_aws_report_upload_bucket_endpoint }}/${{ inputs.build_timestamp }}-vulnerabilities-repository-report.json.zip