action.yml

name: "ScanCode action"
description: "Run ScanCode.io pipelines in your workflows"

inputs:
  pipelines:
    description: "Names of the pipelines (comma-separated) and in order."
    default: "scan_codebase"
  output-formats:
    description: "Output formats"
    default: "json xlsx spdx cyclonedx"
  inputs-path:
    description: "Relative path within the $GITHUB_WORKSPACE for pipeline inputs"
    default: "scancode-inputs"
  input-urls:
    description: "Provide one or more URLs to download for the pipeline run execution."
    required: false
    default: ""
  project-name:
    description: "Name of the project."
    default: "scancode-action"
  outputs-archive-name:
    description: "Name of the outputs archive."
    default: "scancode-outputs"
  check-compliance:
    description: |
      Check for compliance issues in the project.
      Exits with a non-zero status if compliance issues are detected.
    required: false
    default: "false"
  compliance-fail-level:
    description: "Failure level for compliance check. Options: ERROR, WARNING, MISSING."
    required: false
    default: "ERROR"
  compliance-fail-on-vulnerabilities:
    description: |
      Exit with a non-zero status if known vulnerabilities are detected in discovered
      packages and dependencies.
    required: false
    default: "false"
  scancodeio-image:
    description: "ScanCode.io Docker image to use."
    default: "ghcr.io/aboutcode-org/scancode.io@sha256:6fc8023bc588602ef2ec2b699c2503d8771fe5ef16470475fe64b641f0955f5b"  # v37.1.0

runs:
  using: "composite"
  steps:
    - name: Validate inputs
      shell: bash
      env:
        INPUT_IMAGE: ${{ inputs.scancodeio-image }}
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
        INPUT_FAIL_LEVEL: ${{ inputs.compliance-fail-level }}
        INPUT_PIPELINES: ${{ inputs.pipelines }}
      run: |
        # Docker image ref: registry/name:tag or registry/name@sha256:digest
        if [[ ! "$INPUT_IMAGE" =~ ^[a-zA-Z0-9./_:@-]+$ ]]; then
          echo "::error::Invalid image name: $INPUT_IMAGE"
          exit 1
        fi

        # Project name: alphanumeric, spaces, hyphens, underscores, dots
        if [[ ! "$INPUT_PROJECT_NAME" =~ ^[a-zA-Z0-9[:space:]._-]+$ ]]; then
          echo "::error::Invalid project name: $INPUT_PROJECT_NAME"
          exit 1
        fi

        # Fail level: only known values
        if [[ ! "$INPUT_FAIL_LEVEL" =~ ^(ERROR|WARNING|MISSING)$ ]]; then
          echo "::error::Invalid compliance-fail-level: $INPUT_FAIL_LEVEL"
          exit 1
        fi

        # Pipeline names: alphanumeric, underscores, commas, colons
        if [[ ! "$INPUT_PIPELINES" =~ ^[a-zA-Z0-9_,:[:space:]]+$ ]]; then
          echo "::error::Invalid pipelines value: $INPUT_PIPELINES"
          exit 1
        fi

    - name: Set up environment
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
        INPUT_IMAGE: ${{ inputs.scancodeio-image }}
      run: |
        echo "SECRET_KEY=$(openssl rand -base64 32)" >> "$GITHUB_ENV"
        # Workspace location mounted into the container, so outputs are directly accessible
        echo "SCANCODEIO_WORKSPACE_LOCATION=/workspace/.scancodeio" >> "$GITHUB_ENV"
        echo "SCANCODEIO_IMAGE=$INPUT_IMAGE" >> "$GITHUB_ENV"
        # Sanitize project name for artifact usage
        echo "SAFE_PROJECT_NAME=${INPUT_PROJECT_NAME//[^a-zA-Z0-9._-]/_}" >> "$GITHUB_ENV"

    - name: Start and setup the PostgreSQL service
      shell: bash
      run: |
        if ! sudo systemctl is-active --quiet postgresql; then
          sudo systemctl start postgresql.service
          sudo -u postgres psql -c "CREATE USER scancodeio WITH CREATEDB ENCRYPTED PASSWORD 'scancodeio';"
          sudo -u postgres createdb --owner=scancodeio --encoding=UTF-8 scancodeio
        fi

    - name: Write scanpipe wrapper script
      shell: bash
      run: |
        if [ -f "$RUNNER_TEMP/scanpipe" ]; then exit 0; fi
        cat > "$RUNNER_TEMP/scanpipe" << 'EOF'
        #!/usr/bin/env bash
        set -euo pipefail
        exec docker run --rm \
          --network host \
          --user "$(id -u):$(id -g)" \
          --cap-drop ALL \
          --security-opt no-new-privileges \
          -e SECRET_KEY \
          -e SCANCODEIO_WORKSPACE_LOCATION \
          -e HOME=/workspace/.home \
          -v "$GITHUB_WORKSPACE:/workspace" \
          "$SCANCODEIO_IMAGE" \
          scanpipe "$@"
        EOF
        chmod +x "$RUNNER_TEMP/scanpipe"
        echo "$RUNNER_TEMP" >> "$GITHUB_PATH"

    - name: Run migrations to prepare the database
      shell: bash
      run: scanpipe migrate --verbosity 0

    - name: Generate `--pipeline` CLI arguments
      shell: bash
      env:
        INPUT_PIPELINES: ${{ inputs.pipelines }}
      run: |
        IFS=',' read -ra PIPELINES <<< "$INPUT_PIPELINES"
        PIPELINE_CLI_ARGS=""
        for pipeline in "${PIPELINES[@]}"; do
          pipeline="$(echo "$pipeline" | tr -d '[:space:]')"
          PIPELINE_CLI_ARGS+=" --pipeline $pipeline"
        done
        echo "PIPELINE_CLI_ARGS=${PIPELINE_CLI_ARGS}" >> "$GITHUB_ENV"

    - name: Generate `--input-url` CLI arguments
      shell: bash
      env:
        INPUT_URLS: ${{ inputs.input-urls }}
      run: |
        INPUT_URL_CLI_ARGS=""
        for url in $INPUT_URLS; do
          if [[ "$url" =~ ^(https?|docker|pkg): ]]; then
            INPUT_URL_CLI_ARGS+=" --input-url $url"
          else
            echo "::warning::Skipping unsupported URL scheme: $url"
          fi
        done
        echo "INPUT_URL_CLI_ARGS=${INPUT_URL_CLI_ARGS}" >> "$GITHUB_ENV"

    - name: Create project
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
      run: |
        scanpipe create-project "$INPUT_PROJECT_NAME" \
          $PIPELINE_CLI_ARGS \
          $INPUT_URL_CLI_ARGS

    - name: Set project work directory in the environment
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
      run: |
        project_status=$(scanpipe status --project "$INPUT_PROJECT_NAME")
        container_work_dir=$(echo "$project_status" | grep -oP 'Work directory:\s*\K[^\n]+')
        host_work_dir="$GITHUB_WORKSPACE${container_work_dir#/workspace}"
        echo "PROJECT_WORK_DIRECTORY=$host_work_dir" >> "$GITHUB_ENV"

    - name: Copy input files to project work directory
      if: ${{ !inputs.input-urls }}
      shell: bash
      env:
        INPUT_INPUTS_PATH: ${{ inputs.inputs-path }}
        WORKSPACE: ${{ github.workspace }}
      run: |
        SOURCE_PATH="$INPUT_INPUTS_PATH"
        [[ "$SOURCE_PATH" != /* ]] && SOURCE_PATH="${WORKSPACE}/$SOURCE_PATH"

        # Prevent path traversal outside the workspace
        REAL_SOURCE=$(realpath -m "$SOURCE_PATH")
        REAL_WORKSPACE=$(realpath "$WORKSPACE")
        if [[ "$REAL_SOURCE" != "$REAL_WORKSPACE"* ]]; then
          echo "::error::inputs-path resolves outside the workspace. Aborting."
          exit 1
        fi

        DESTINATION_PATH="${PROJECT_WORK_DIRECTORY}/input/"
        mkdir -p "$DESTINATION_PATH"

        if [ -d "$SOURCE_PATH" ]; then
          if [ "$(ls -A "$SOURCE_PATH")" ]; then
            echo "Copying contents of directory: $SOURCE_PATH -> $DESTINATION_PATH"
            cp -r "$SOURCE_PATH"/* "$DESTINATION_PATH"
          else
            echo "Input directory '$SOURCE_PATH' is empty, nothing to copy."
          fi
        elif [[ -f "$SOURCE_PATH" ]]; then
          echo "Copying file: $SOURCE_PATH -> $DESTINATION_PATH"
          cp "$SOURCE_PATH" "$DESTINATION_PATH"
        fi

        echo ""
        echo "Input files now in: $DESTINATION_PATH"
        ls -lh "$DESTINATION_PATH"

    - name: Run the pipelines
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
      run: scanpipe execute --project "$INPUT_PROJECT_NAME" --no-color

    - name: Generate outputs
      id: scanpipe
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
        INPUT_OUTPUT_FORMATS: ${{ inputs.output-formats }}
      run: |
        scanpipe output \
          --project "$INPUT_PROJECT_NAME" \
          --format $INPUT_OUTPUT_FORMATS

    - name: Upload outputs
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
      id: artifact-upload-step
      with:
        # Include the project name in case of multiple runs of the action
        name: ${{ inputs.outputs-archive-name }}-${{ env.SAFE_PROJECT_NAME }}
        path: ${{ env.PROJECT_WORK_DIRECTORY }}/output/*
        overwrite: true

    - name: Check compliance
      if: inputs.check-compliance == 'true'
      shell: bash
      env:
        INPUT_PROJECT_NAME: ${{ inputs.project-name }}
        INPUT_FAIL_LEVEL: ${{ inputs.compliance-fail-level }}
        INPUT_FAIL_ON_VULNS: ${{ inputs.compliance-fail-on-vulnerabilities }}
      run: |
        cmd=(
          scanpipe check-compliance
          --project "$INPUT_PROJECT_NAME"
          --fail-level "$INPUT_FAIL_LEVEL"
        )

        if [[ "$INPUT_FAIL_ON_VULNS" == "true" ]]; then
          cmd+=(--fail-on-vulnerabilities)
        fi

        "${cmd[@]}"