public-ui-kolibri

name: 'Security Scan'
description: 'Runs pnpm audit, Trivy and ClamAV scans with a summary report.'
inputs:
  enable-audit:
    description: 'Whether to run pnpm audit.'
    required: false
    default: 'true'
  enable-trivy:
    description: 'Whether to run the Trivy scan.'
    required: false
    default: 'true'
  enable-clamav:
    description: 'Whether to run the ClamAV scan.'
    required: false
    default: 'true'
  install-deps:
    description: 'Whether to install dependencies before running the scans.'
    required: false
    default: 'false'
runs:
  using: 'composite'
  steps:
    - name: Install dependencies
      if: ${{ inputs.install-deps == 'true' }}
      shell: bash
      run: pnpm install --frozen-lockfile

    - name: Run pnpm audit
      id: pnpm_audit
      if: ${{ inputs.enable-audit == 'true' }}
      shell: bash
      run: pnpm audit --audit-level high
      continue-on-error: true

    - name: Scan repository with Trivy
      id: trivy
      if: ${{ inputs.enable-trivy == 'true' }}
      uses: aquasecurity/trivy-action@0.28.0
      with:
        scan-type: 'fs'
        scan-ref: '.'
        ignore-unfixed: true
        vuln-type: 'os,library'
        severity: 'CRITICAL,HIGH'
        format: 'table'
        exit-code: '1'
      continue-on-error: true

    - name: Scan repository with ClamAV
      id: clamav
      if: ${{ inputs.enable-clamav == 'true' }}
      uses: djdefi/gitavscan@main
      continue-on-error: true

    - name: Summarize scan results
      if: ${{ always() }}
      env:
        PNPM_AUDIT_OUTCOME: ${{ steps.pnpm_audit.outcome }}
        TRIVY_OUTCOME: ${{ steps.trivy.outcome }}
        CLAMAV_OUTCOME: ${{ steps.clamav.outcome }}
        RUN_PNPM_AUDIT: ${{ inputs.enable-audit }}
        RUN_TRIVY: ${{ inputs.enable-trivy }}
        RUN_CLAMAV: ${{ inputs.enable-clamav }}
      shell: bash
      run: |
        printf '| Step | Outcome |\n' >> "$GITHUB_STEP_SUMMARY"
        printf '| --- | --- |\n' >> "$GITHUB_STEP_SUMMARY"

        pnpm_audit_outcome="$PNPM_AUDIT_OUTCOME"
        if [[ "$RUN_PNPM_AUDIT" != 'true' ]]; then
          pnpm_audit_outcome='skipped'
        fi
        printf '| pnpm audit | %s |\n' "$pnpm_audit_outcome" >> "$GITHUB_STEP_SUMMARY"

        trivy_outcome="$TRIVY_OUTCOME"
        if [[ "$RUN_TRIVY" != 'true' ]]; then
          trivy_outcome='skipped'
        fi
        printf '| Trivy | %s |\n' "$trivy_outcome" >> "$GITHUB_STEP_SUMMARY"

        clamav_outcome="$CLAMAV_OUTCOME"
        if [[ "$RUN_CLAMAV" != 'true' ]]; then
          clamav_outcome='skipped'
        fi
        printf '| ClamAV | %s |\n' "$clamav_outcome" >> "$GITHUB_STEP_SUMMARY"

        if [[ ("$pnpm_audit_outcome" != 'success' && "$pnpm_audit_outcome" != 'skipped') || \
              ("$trivy_outcome" != 'success' && "$trivy_outcome" != 'skipped') || \
              ("$clamav_outcome" != 'success' && "$clamav_outcome" != 'skipped') ]]; then
          echo 'One or more security scans reported a problem.' >> "$GITHUB_STEP_SUMMARY"
          exit 1
        fi