vulnerability-scan.yml

# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "Vulnerability Scan"
on:
  schedule:
    # Run every Monday at 03:00 UTC
    - cron: '0 3 * * 1'
  workflow_dispatch:
  # Opt in per pull request by applying the "vulnerability scan" label. Applying a label
  # requires write access, so only a committer can start a scan.
  pull_request:
    types: [labeled, synchronize, reopened]
  # Used only to tell a fork pull request that it cannot be scanned. A `pull_request` run
  # raised from a fork gets neither the Sonatype credentials nor a token that can comment,
  # so the notice has to come from `pull_request_target`. That job checks out the base
  # branch and never runs anything from the pull request.
  pull_request_target:
    types: [labeled, synchronize, reopened]
# Do not scan concurrently; OSS Index has per-account rate limits.
# The event name is part of the group so the `pull_request` scan and the `pull_request_target`
# notice for the same pull request cannot cancel one another.
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
jobs:
  scan-grails-core:
    name: "OSS Index Scan - grails-core"
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@v6
      - name: "☕️ Determine Java version from .sdkmanrc"
        # Read the JDK the build targets out of the file that already declares it, so a
        # baseline bump does not leave a stale literal behind here. Only the major is kept:
        # a scan is outside the reproducible-build surface, so CI takes the runner's current
        # release of that major rather than pinning the patch version.
        id: sdkmanrc
        run: |
          set -euo pipefail
          sdkman_java=$(grep -E '^java=' .sdkmanrc | cut -d= -f2 || true)
          if [ -z "${sdkman_java}" ]; then
            echo "❌ Could not determine the java version from .sdkmanrc" >&2
            exit 1
          fi
          echo "Scanning with JDK ${sdkman_java%%.*} (from .sdkmanrc: ${sdkman_java})"
          echo "java-version=${sdkman_java%%.*}" >> "$GITHUB_OUTPUT"
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@v4
        with:
          distribution: liberica
          java-version: ${{ steps.sdkmanrc.outputs.java-version }}
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🔍 Run OSS Index Vulnerability Scan"
        env:
          SONATYPE_GUIDE_USERNAME: ${{ secrets.SONATYPE_GUIDE_USERNAME }}
          SONATYPE_GUIDE_TOKEN: ${{ secrets.SONATYPE_GUIDE_TOKEN }}
        continue-on-error: true
        id: scan
        run: ./gradlew ossIndexAudit --continue --info 2>&1 | tee /tmp/ossindex-scan.log; exit ${PIPESTATUS[0]}
      - name: "📋 Publish Vulnerability Summary"
        if: always()
        run: >
          .github/scripts/ossIndexReport.sh
          /tmp/ossindex-scan.log
          '${{ steps.scan.outcome }}'
          '🔍 OSS Index Vulnerability Scan — grails-core'
          >> $GITHUB_STEP_SUMMARY

  scan-pull-request:
    name: "OSS Index Scan - pull request"
    # `synchronize` and `reopened` re-scan a pull request that already carries the label.
    if: >-
      github.event_name == 'pull_request'
      && contains(github.event.pull_request.labels.*.name, 'vulnerability scan')
      && github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: "📥 Checkout pull request"
        uses: actions/checkout@v6
      - name: "☕️ Determine Java version from .sdkmanrc"
        # Read the JDK the build targets out of the file that already declares it, so a
        # baseline bump does not leave a stale literal behind here. Only the major is kept:
        # a scan is outside the reproducible-build surface, so CI takes the runner's current
        # release of that major rather than pinning the patch version.
        id: sdkmanrc
        run: |
          set -euo pipefail
          sdkman_java=$(grep -E '^java=' .sdkmanrc | cut -d= -f2 || true)
          if [ -z "${sdkman_java}" ]; then
            echo "❌ Could not determine the java version from .sdkmanrc" >&2
            exit 1
          fi
          echo "Scanning with JDK ${sdkman_java%%.*} (from .sdkmanrc: ${sdkman_java})"
          echo "java-version=${sdkman_java%%.*}" >> "$GITHUB_OUTPUT"
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@v4
        with:
          distribution: liberica
          java-version: ${{ steps.sdkmanrc.outputs.java-version }}
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
        with:
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🔍 Run OSS Index Vulnerability Scan"
        env:
          SONATYPE_GUIDE_USERNAME: ${{ secrets.SONATYPE_GUIDE_USERNAME }}
          SONATYPE_GUIDE_TOKEN: ${{ secrets.SONATYPE_GUIDE_TOKEN }}
        continue-on-error: true
        id: scan
        run: ./gradlew ossIndexAudit --continue --info 2>&1 | tee /tmp/ossindex-scan.log; exit ${PIPESTATUS[0]}
      - name: "📋 Build Vulnerability Report"
        if: always()
        # 60000 bytes keeps the listing clear of GitHub's 65536 character comment limit.
        run: >
          .github/scripts/ossIndexReport.sh
          /tmp/ossindex-scan.log
          '${{ steps.scan.outcome }}'
          '🔍 OSS Index Vulnerability Scan — pull request'
          60000
          > /tmp/ossindex-report.md
      - name: "📝 Publish Vulnerability Summary"
        if: always()
        run: cat /tmp/ossindex-report.md >> $GITHUB_STEP_SUMMARY
      - name: "💬 Comment Vulnerability Report"
        if: always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          .github/scripts/postStickyComment.sh
          '${{ github.event.pull_request.number }}'
          '<!-- grails-vulnerability-scan -->'
          /tmp/ossindex-report.md

  notify-fork-pull-request:
    name: "OSS Index Scan - unavailable"
    # A fork pull request cannot reach the Sonatype credentials, so say so instead of
    # leaving the label looking as though a scan ran.
    if: >-
      github.event_name == 'pull_request_target'
      && contains(github.event.pull_request.labels.*.name, 'vulnerability scan')
      && github.event.pull_request.head.repo.full_name != github.repository
    runs-on: ubuntu-24.04
    permissions:
      pull-requests: write
    steps:
      # Checks out the base branch, not the pull request; nothing from the fork is executed.
      - name: "📥 Checkout base branch"
        uses: actions/checkout@v6
      - name: "📋 Build Notice"
        run: |
          {
            echo "## 🔍 OSS Index Vulnerability Scan — pull request"
            echo "⚠️ Vulnerability scanning is not available because this branch is not on \`${{ github.repository }}\`."
            echo
            echo "The scan needs Sonatype Guide credentials, which GitHub withholds from workflow runs raised by a fork. Push the branch to \`${{ github.repository }}\` and open a pull request from there to have it scanned."
          } > /tmp/ossindex-report.md
      - name: "💬 Comment Notice"
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: >
          .github/scripts/postStickyComment.sh
          '${{ github.event.pull_request.number }}'
          '<!-- grails-vulnerability-scan -->'
          /tmp/ossindex-report.md