action.yml

name: "Open Source Project Security Baseline Scanner"
description: "Run Open Source Project Security Baseline assessments on your GitHub repository"
author: "Revanite"

branding:
  icon: "shield"
  color: "blue"

inputs:
  owner:
    description: "Repository owner (organization or user)"
    required: true
  repo:
    description: "Repository name"
    required: true
  token:
    description: "GitHub Personal Access Token with repo read permissions"
    required: true
  catalog:
    description: "OSPS catalog to assess against"
    required: false
    default: "osps-baseline"
  output-format:
    description: "Output format (yaml, json, or sarif)"
    required: false
    default: "yaml"
  upload-sarif:
    description: "Upload results as SARIF to GitHub Security tab. When true, output-format is automatically set to sarif"
    required: false
    default: "false"
  sarif-only-failures:
    description: "Upload only failed controls (error-level results) to GitHub Code Scanning. Needs-review and passed controls stay in the workflow summary and results files. Set to false to upload all results"
    required: false
    default: "true"
  fail-on-error:
    description: "Fail the workflow if any controls have errors. When false, results are reported but the step always passes"
    required: false
    default: "false"

outputs:
  results-path:
    description: "Path to the evaluation results directory"
    value: "evaluation_results"

runs:
  using: "composite"
  steps:
    - name: Create config file
      shell: bash
      env:
        OUTPUT_FORMAT: ${{ inputs.output-format }}
        CATALOG: ${{ inputs.catalog }}
        OWNER: ${{ inputs.owner }}
        REPO: ${{ inputs.repo }}
        TOKEN: ${{ inputs.token }}
        UPLOAD_SARIF: ${{ inputs.upload-sarif }}
      run: |
        # If upload-sarif is enabled, use sarif output format
        if [ "$UPLOAD_SARIF" = "true" ]; then
          FINAL_OUTPUT_FORMAT="sarif"
        else
          FINAL_OUTPUT_FORMAT="$OUTPUT_FORMAT"
        fi

        cat > /tmp/pvtr-config.yml << EOF
        loglevel: "info"
        write-directory: evaluation_results
        write: true
        output: "$FINAL_OUTPUT_FORMAT"
        services:
          pvtr:
            plugin: github-repo
            policy:
              catalogs:
                - "$CATALOG"
              applicability:
                - "Maturity Level 1"
            vars:
              owner: "$OWNER"
              repo: "$REPO"
              token: "$TOKEN"
        EOF

    - name: Prepare writable results directory
      shell: bash
      run: |
        mkdir -p evaluation_results
        chmod 777 evaluation_results

    - name: Run OSPS Assessment
      shell: bash
      run: |
        docker run --rm \
          -v /tmp/pvtr-config.yml:/.privateer/config.yml \
          -v ${{ github.workspace }}/evaluation_results:/.privateer/bin/evaluation_results \
          ghcr.io/ossf/pvtr-github-repo-scanner:v0.29.0@sha256:85d723bdd1f49065c27c9509e18b29cc7ac8971118a9e57b97c3bca901c52e7d

    - name: Write results to workflow summary
      shell: bash
      env:
        OWNER: ${{ inputs.owner }}
        REPO: ${{ inputs.repo }}
        CATALOG: ${{ inputs.catalog }}
        FAIL_ON_ERROR: ${{ inputs.fail-on-error }}
        RESULTS_DIR: evaluation_results
      run: bash ${{ github.action_path }}/scripts/write-summary.sh

    - name: Prepare SARIF file for upload
      shell: bash
      id: sarif
      if: inputs.upload-sarif == 'true'
      env:
        RESULTS_DIR: evaluation_results
        SARIF_ONLY_FAILURES: ${{ inputs.sarif-only-failures }}
      run: bash ${{ github.action_path }}/scripts/prepare-sarif.sh

    - name: Upload SARIF to GitHub Security tab
      if: inputs.upload-sarif == 'true' && steps.sarif.outputs.sarif_file != '' && steps.sarif.outputs.has_results == 'true'
      uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
      with:
        sarif_file: ${{ steps.sarif.outputs.sarif_file }}
        wait-for-processing: true
      continue-on-error: true

    - name: Cleanup temporary config file
      shell: bash
      if: always()
      run: |
        if [ -f /tmp/pvtr-config.yml ]; then
          rm -f /tmp/pvtr-config.yml
        fi