scan.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "Security vulnerability scan"

on:
  workflow_call:
    inputs:
      ref:
        description: Branch, tag or SHA to scan.
        type: string
        required: false
        default: ""

permissions:
  contents: read

jobs:
  pip-audit:
    name: pip-audit
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.ref }}
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.11'
          cache: 'pip'

      - name: Install project dependencies
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements.txt
          # The runner pre-installs outdated setuptools/wheel; pip-audit audits
          # the ENTIRE environment, so we update them to versions without CVEs.
          python -m pip install --upgrade setuptools wheel

      - name: Install pip-audit
        run: python -m pip install pip-audit

      - name: Audit requirements.txt (JSON)
        run: |
          pip-audit -r requirements.txt --format json --output audit-requirements.json

      - name: Audit installed environment (JSON)
        run: |
          pip-audit --format json --output audit-env.json

      - name: Publish pip-audit summary to run summary
        env:
          GITHUB_STEP_SUMMARY: ${{ github.step_summary }}
        run: |
          python - <<'PY'
          import json, os, pathlib

          def summarize(path):
              p = pathlib.Path(path)
              if not p.exists():
                  return 0
              try:
                  d = json.loads(p.read_text())
                  if isinstance(d, list):
                      return len(d)
                  if isinstance(d, dict):
                      for k in ('vulns','vulnerabilities','results'):
                          if k in d and isinstance(d[k], list):
                              return len(d[k])
                      # Fallback: count top-level list-like values
                      total = 0
                      for v in d.values():
                          if isinstance(v, list):
                              total += len(v)
                      return total
              except Exception:
                  return 0

          req = summarize('audit-requirements.json')
          env = summarize('audit-env.json')
          summary = f"## pip-audit summary\n- requirements.txt vulnerabilities: {req}\n- installed environment vulnerabilities: {env}\n"
          print(summary)
          target = os.environ.get('GITHUB_STEP_SUMMARY')
          if target:
              with open(target, 'a') as fh:
                  fh.write(summary)
          else:
              # Fallback to printing if summary file not available in older runners
              print('GITHUB_STEP_SUMMARY not set; summary printed above')
          PY

      - name: Upload pip-audit JSON artifacts
        uses: actions/upload-artifact@v4
        with:
          name: pip-audit-results
          path: |
            audit-requirements.json
            audit-env.json