action.yml

name: "Proxy action"
description: "Action that calls other actions - security actions"

inputs:
  API_ID: # id of input
    description: "Veracode API_ID"
    required: true
    # default: "World"
  API_KEY: # id of input
    description: "Veracode API_KEY"
    required: true
  path: # id of input
    description: "Path to assets"
    required: true
    default: "."

runs:
  using: "composite"
  steps:
    #- run: echo Hello ${{ inputs.who-to-greet }}.
    #  shell: bash
    #- id: random-number-generator
    #  run: echo "::set-output name=random-id::$(echo $RANDOM)"
    #  shell: bash
    #- run: echo "${{ github.action_path }}" >> $GITHUB_PATH
    #  shell: bash

    #- run: zip -r tractus.zip .
    #  shell: bash

    #- run: ls -l
    #  shell: bash

    #- run: cat results.json
    #  shell: bash

    - run: ls -l -a
      shell: bash

    # --- Software Composition Analysis (SCA) ---
    - name: Dependency Check
      uses: dependency-check/Dependency-Check_Action@main
      with:
        project: "test"
        # Automatically searches for dependency manager files in the repository
        path: "."
        # Exports the results in SARIF format for SARIF upload.
        # Alternatively, other report formats can be selected, see command line arguments.
        format: "SARIF"
        # If results with a high severity are found, the workflow fails.
        args: >
          --failOnCVSS 7
          --enableRetired
      if: always()

    - name: Upload DependencyCheck output as artifact
      uses: actions/upload-artifact@v1
      with:
        name: dependency-check-report-sarif
        path: ${{ github.workspace }}/reports
      if: always()

    # Upload findings to GitHub Advanced Security Dashboard
    - name: Upload SARIF file for GitHub Advanced Security Dashboard
      uses: github/codeql-action/upload-sarif@v1
      with:
        # Path to SARIF file relative to the root of the repository
        sarif_file: ${{ github.workspace }}/reports/dependency-check-report.sarif
      if: always()

    # --- Static Application Security Testing (SAST) ---
    - uses: returntocorp/semgrep-action@v1
      id: semgrep
      with:
        config: >- # more at semgrep.dev/explore
          p/security-audit
          p/owasp-top-ten
          p/xss
          p/r2c
          p/react
          p/secrets
          p/docker
          p/typescript
        generateSarif: "1"
      if: always()

      # == Optional settings in the `with:` block
      # Instead of `config:`, use rules set in Semgrep App.
      # Get your token from semgrep.dev/manage/settings.
      #   publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}

      # Never fail the build due to findings on pushes.
      # Instead, just collect findings for semgrep.dev/manage/findings
      #   auditOn: push

      # Upload findings to GitHub Advanced Security Dashboard [step 1/2]
      # See also the next step.
      #   generateSarif: "1"

      # Change job timeout (default is 1800 seconds; set to 0 to disable)
      # env:
      #   SEMGREP_TIMEOUT: 300

    - name: Upload Semgrep output as artifact
      uses: actions/upload-artifact@v1
      with:
        name: semgrep.sarif
        path: semgrep.sarif
      if: always()

    # Upload findings to GitHub Advanced Security Dashboard [step 2/2]
    - name: Upload SARIF file for GitHub Advanced Security Dashboard
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: semgrep.sarif
      if: always()

branding:
  icon: "activity"
  color: "gray-dark"