scan.yaml

---
name: Scan all images
on:
  workflow_dispatch:
  schedule:
    - cron: '30 2 * * *'

permissions: {}

jobs:
  scan_images:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      # Oh Dear only gets pinged by scheduled runs, so a manual run cannot hide a missed nightly scan
      - name: Report start to Oh Dear
        if: github.event_name == 'schedule'
        continue-on-error: true
        env:
          OH_DEAR_PING_URL: ${{ secrets.OH_DEAR_PING_URL }}
        run: curl -fsS --retry 3 -o /dev/null "$OH_DEAR_PING_URL/starting"
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Init submodules
        run: git submodule update --init --recursive
      - name: Set up Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: 3.11
      - name: Setup Rust
        run: rustup toolchain install stable --profile minimal
      - name: Run image
        uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
        with:
          poetry-version: 1.7.1
      - name: Install CycloneDX CLI
        run: |
          curl -sSfL https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.30.0/cyclonedx-linux-x64 -o /usr/local/bin/cyclonedx
          chmod +x /usr/local/bin/cyclonedx
      - name: Install deps
        run: poetry install
      - name: Scan dev plus current and previous release
        run: poetry run python stack_scanner/main.py scan-latest ${{ secrets.SECOBSERVE_API_TOKEN }}
      - name: Report success to Oh Dear
        if: success() && github.event_name == 'schedule'
        continue-on-error: true
        env:
          OH_DEAR_PING_URL: ${{ secrets.OH_DEAR_PING_URL }}
        run: curl -fsS --retry 3 -o /dev/null "$OH_DEAR_PING_URL"
      - name: Report failure to Oh Dear
        if: (failure() || cancelled()) && github.event_name == 'schedule'
        continue-on-error: true
        env:
          OH_DEAR_PING_URL: ${{ secrets.OH_DEAR_PING_URL }}
        run: |
          curl -fsS --retry 3 -o /dev/null "$OH_DEAR_PING_URL" \
            --data-urlencode "exit_code=1" \
            --data-urlencode "failure_message=Run ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} failed"