osv-scanner-reusable-pr.yml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: OSV-Scanner PR scanning reusable

permissions:
  contents: read
  security-events: write

on:
  workflow_call:
    inputs:
      scan-args:
        description: "Custom osv-scanner arguments (See https://google.github.io/osv-scanner/usage/ for options, you cannot set --format or --output)"
        type: string
        default: |-
          -r
          --skip-git
          ./
      results-file-name:
        description: "File name of the result SARIF file"
        type: string
        default: results.sarif
      upload-sarif:
        description: "Whether to upload to Security > Code Scanning"sarif
        type: bool
        default: true

jobs:
  scan-pr:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          fetch-depth: 0
          # Do persist credentials, as we need it for the git checkout later
      - name: "Checkout target branch"
        run: git checkout $GITHUB_BASE_REF
      - name: "Run scanner on existing code"
        uses: google/osv-scanner/actions/scanner@main
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=old-results.json
            ${{ inputs.scan-args }}
      - name: "Checkout current branch"
        run: git checkout $GITHUB_SHA
      - name: "Run scanner on new code"
        uses: google/osv-scanner/actions/scanner@main
        with:
          scan-args: |-
            --format=json
            --output=new-results.json
            ${{ inputs.scan-args }}
        continue-on-error: true
      - name: "Run osv-scanner-reporter"
        uses: google/osv-scanner/actions/reporter@main
        with:
          scan-args: |-
            --output=${{ inputs.results-file-name }}
            --old=old-results.json
            --new=new-results.json
            --gh-annotations=true
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        if: '!cancelled()'
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: SARIF file
          path: ${{ inputs.results-file-name }}
          retention-days: 5
      - name: "Upload old scan json results"
        if: '!cancelled()'
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: old-json-results
          path: old-results.json
          retention-days: 5
      - name: "Upload new scan json results"
        if: '!cancelled()'
        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
        with:
          name: new-json-results
          path: new-results.json
          retention-days: 5
      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
        if: '!cancelled() && ${{ inputs.upload-sarif }}'
        uses: github/codeql-action/upload-sarif@407ffafae6a767df3e0230c3df91b6443ae8df75 # v2.22.8
        with:
          sarif_file: ${{ inputs.results-file-name }}