main.yml

name: "build-test"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:
  build:
    # make sure build/ci work properly
    runs-on: ubuntu-latest
    env:
      MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }}
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0
      - run: |
          npm install
      - run: |
          npm run all

  test-some-outputs:
    # make sure the action works on a clean machine without building
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        id: mcode-action
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          sarif-output: out/sarif/
          package: __tests__/lighttpd
          args: --image forallsecure/lighttpd:vulnerable --duration 60

      - name: Upload SARIF file(s)
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: out/sarif

      - name: Print runId (${{ steps.mcode-action.outputs.runId }}) and test it's non-empty
        run: |
          [ -z "${{ steps.mcode-action.outputs.runId }}" ] && echo "runId was blank!" && exit 1;
          echo "The run id was: ${{ steps.mcode-action.outputs.runId }}"

  test-all-outputs:
    # make sure the action works on a clean machine without building
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        id: mcode-action
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          junit-output: out/junit/
          sarif-output: out/sarif/
          coverage-output: out/coverage/
          package: __tests__/lighttpd
          args: --image forallsecure/lighttpd:vulnerable --duration 60

      - name: Archive Coverage report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-report
          path: out/coverage/
          if-no-files-found: error

      - name: Archive JUnit results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mcode-junit
          path: out/junit/
          if-no-files-found: error

      - name: Upload SARIF file(s)
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: out/sarif

      - name: Print runId (${{ steps.mcode-action.outputs.runId }}) and test it's non-empty
        run: |
          [ -z "${{ steps.mcode-action.outputs.runId }}" ] && echo "runId was blank!" && exit 1;
          echo "The run id was: ${{ steps.mcode-action.outputs.runId }}"

  test-no-outputs:
    # make sure the action works on a clean machine without building
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        id: mcode-action
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          package: __tests__/lighttpd
          args: --image forallsecure/lighttpd:vulnerable --duration 60

      - name: Print runId (${{ steps.mcode-action.outputs.runId }}) and test it's non-empty
        run: |
          [ -z "${{ steps.mcode-action.outputs.runId }}" ] && echo "runId was blank!" && exit 1;
          echo "The run id was: ${{ steps.mcode-action.outputs.runId }}"

  # note: requires human inspection by checking the output and seeing the overrided inputs are picked up.
  test-override-inputs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        id: mcode-action
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          package: __tests__/lighttpd
          args: --image forallsecure/lighttpd:vulnerable --duration 60
          # override the default owner which is forallsecure
          # the secrets.MAYHEM_TOKEN is this case is owned by mcode-action, which is why we choose that owner here
          owner: mcode-action
          # override default verbosity which is info (contrary to what the `action.yml` says: https://github.com/ForAllSecure/mcode-action/blob/806778bb4a79d793f678087d0f9f3ff18f9a2d93/src/main.ts#L36)
          verbosity: debug
          # already covered and skipped in this test: mayhem-token, mayhem-url, github-token, sarif|junit|coverage-output, args

      - name: Print runId (${{ steps.mcode-action.outputs.runId }}) and test it's non-empty
        run: |
          [ -z "${{ steps.mcode-action.outputs.runId }}" ] && echo "runId was blank!" && exit 1;
          echo "The run id was: ${{ steps.mcode-action.outputs.runId }}"

  test-fail-on-defects:
    # make sure the action works on a clean machine without building
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          # fetch entire history to compute diffs between jobs
          fetch-depth: 0

      - uses: ./
        id: mcode-action
        continue-on-error: true
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          package: __tests__/mayhemit
          args: --image forallsecure/c-base-executable:latest --duration 60
          fail-on-defects: true

      # Previous step should fail
      - name: Invert success and failure
        run: if [[ ${{ steps.mcode-action.outcome }} == "failure" ]]; then exit 0; else exit 1; fi

      - name: Print runId (${{ steps.mcode-action.outputs.runId }}) and test it's non-empty
        run: |
          [ -z "${{ steps.mcode-action.outputs.runId }}" ] && echo "runId was blank!" && exit 1;
          echo "The run id was: ${{ steps.mcode-action.outputs.runId }}"

  # End-to-end check for the run revision, dispatch only (it starts a real Mayhem run): check out a
  # commit that differs from GITHUB_SHA (the parent of the dispatched ref), run the action against it,
  # and assert the run Mayhem records carries that checked-out commit — the reusable-workflow case where
  # the fuzzed commit is not the one the workflow run started from.
  #   gh workflow run main.yml --ref <branch>
  revision-from-checkout:
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          fetch-depth: 2

      - name: Second checkout at the parent commit (differs from GITHUB_SHA)
        id: pkg
        run: |
          parent="$(git rev-parse HEAD~1)"
          git clone -q . pkg
          git -C pkg checkout -q "$parent"
          echo "parent=$parent" >> "$GITHUB_OUTPUT"
          echo "GITHUB_SHA=$GITHUB_SHA"
          echo "package checkout=$parent"

      - uses: ./
        id: mcode-action
        with:
          mayhem-url: ${{ secrets.MAYHEM_URL }}
          mayhem-token: ${{ secrets.MAYHEM_TOKEN }}
          github-token: ${{ secrets.GITHUB_TOKEN }}
          package: pkg/__tests__/lighttpd
          args: --image forallsecure/lighttpd:vulnerable --duration 30

      - name: The run must record the checked-out commit, not GITHUB_SHA
        env:
          MAYHEM_TOKEN: ${{ secrets.MAYHEM_TOKEN }}
          MAYHEM_URL: ${{ secrets.MAYHEM_URL }}
          RUN_ID: ${{ steps.mcode-action.outputs.runId }}
          PARENT: ${{ steps.pkg.outputs.parent }}
        run: |
          set -eu
          base="${MAYHEM_URL:-https://app.mayhem.security}"
          IFS=/ read -r owner project target number <<< "$RUN_ID"
          url="$base/api/v2/owner/$owner/project/$project/target/$target/run/$number"
          rev="$(curl -sf -H "X-Mayhem-Token: token $MAYHEM_TOKEN" "$url" | jq -r .revision)"
          echo "run            : $RUN_ID"
          echo "recorded       : $rev"
          echo "checked out    : $PARENT"
          echo "GITHUB_SHA     : $GITHUB_SHA"
          [ "$rev" = "$PARENT" ] || { echo "FAIL: the run does not carry the checked-out commit"; exit 1; }
          [ "$rev" != "$GITHUB_SHA" ] || { echo "FAIL: the run still carries GITHUB_SHA"; exit 1; }
          echo "OK: the run records the commit that was actually checked out"