name: OSV-Scanner

# Scans lockfiles (uv.lock, package-lock.json) against the OSV vulnerability
# database. Runs on every PR/push (via the ci.yml orchestrator's workflow_call)
# and on a weekly schedule against main.
#
# This is detection-only — OSV-Scanner does NOT open PRs or modify pins.
# It reports known CVEs in currently-pinned dependency versions so we can
# decide when and how to patch on our own schedule. Our pinning strategy
# (full SHA / exact version) is preserved; only the notification signal
# is added.
#
# Complements the supply-chain-audit.yml workflow (which scans for malicious
# code patterns in PR diffs) by covering the orthogonal "currently-pinned
# dep became known-vulnerable" case.
#
# Steps below are inlined from Google's officially-recommended reusable
# workflow (google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml),
# rather than called via `uses:` so we can set a `timeout-minutes` in the
# degenerate case where this job hangs.

# Findings land in the repo's Security tab (Code Scanning > OSV-Scanner).
# fail-on-vuln is disabled so the job does not block merges on pre-existing
# vulnerabilities in pinned deps that we may need to patch deliberately.

on:
  workflow_call:
  schedule:
    # Weekly scan against main — catches CVEs published after merge for
    # deps that haven't changed since.
    - cron: '0 9 * * 1'
  workflow_dispatch:

permissions:
  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
  actions: read
  contents: read
  security-events: write

jobs:
  scan:
    name: Scan lockfiles
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: 'Run scanner'
        uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
        with:
          # Scan explicit lockfiles rather than recursing, so we only look at
          # the three sources of truth and skip vendored / test / worktree dirs.
          scan-args: |-
            --output=results.json
            --format=json
            --lockfile=uv.lock
            --lockfile=package-lock.json
            --lockfile=website/package-lock.json
        continue-on-error: true

      - name: 'Run osv-scanner-reporter'
        uses: google/osv-scanner-action/osv-reporter-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8
        with:
          scan-args: |-
            --output=results.sarif
            --new=results.json
            --gh-annotations=false
            --fail-on-vuln=false

      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: 'Upload artifact'
        id: 'upload_artifact'
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        with:
          name: OSV Scanner SARIF file
          path: results.sarif
          retention-days: 5

      # Upload the results to GitHub's code scanning dashboard.
      - name: 'Upload to code-scanning'
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
        with:
          sarif_file: results.sarif

      - name: 'Print Code Scanning URL'
        if: ${{ !cancelled() }}
        run: |
          echo "View the OSV-Scanner results in the 'Security' tab, using the following link:"
          echo "${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=is%3Aopen+branch%3A${GITHUB_REF_NAME}+tool%3Aosv-scanner"
        env:
          GITHUB_REF_NAME: ${{ github.ref_name }}

      - name: 'Error troubleshooter'
        if: ${{ always() && steps.upload_artifact.outcome == 'failure' }}
        run: |
          echo "::error::Artifact upload failed. This is most likely caused by a error during scanning earlier in the workflow."
          exit 1