scheduled-scan.yml

# Copyright the Hyperledger Fabric contributors. All rights reserved.
#
# SPDX-License-Identifier: Apache-2.0

name: "Scheduled vulnerability scan"

on:
  schedule:
    - cron: "20 3 * * *"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  latest-release-version:
    name: Get latest release tag
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      tag_name: ${{ steps.tag-name.outputs.value }}
    steps:
      - id: tag-name
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          # Attempt to get the latest release tag from GitHub Releases API
          tag="$(gh api "repos/${GITHUB_REPOSITORY}/releases/latest" --jq '.tag_name' 2>/dev/null || echo "")"

          # If no release (or API failed), try the repository tags list via the API
          if [ -z "${tag}" ] || [ "${tag}" = "null" ]; then
            tag="$(gh api "repos/${GITHUB_REPOSITORY}/tags" --jq '.[0].name' 2>/dev/null || echo "")"
          fi

          # If still empty, log warning and use main branch as a safe default
          if [ -z "${tag}" ]; then
            echo "::warning::No releases or tags found in ${GITHUB_REPOSITORY}, using main branch for scan"
            tag="main"
          fi

          echo "value=${tag}" >> "${GITHUB_OUTPUT}"

    concurrency:
      group: ${{ github.workflow }}
      cancel-in-progress: false

  scan-release:
    name: Scan ${{ needs.latest-release-version.outputs.tag_name }}
    needs: latest-release-version
    uses: ./.github/workflows/scan.yml
    with:
      ref: ${{ needs.latest-release-version.outputs.tag_name }}

  # This job runs on the `main` branch and scans the `main` branch at the default branch's HEAD. 
  # Without it, vulnerabilities introduced in `main`
  # but not yet released would go unnoticed until the next release.
  scan-latest:
    name: Scan latest
    uses: ./.github/workflows/scan.yml