action.yaml

# Action's main info
name: "Packj Security Audit"
description: 'Use Packj to avoid malicious and other "risky" open-source software dependencies'

# Action's author name
author: "Ossillate, Inc."

# Action's branding data for GitHub Marketplace
branding:
  icon: "package" # icon name from Feather open source icons pack
  color: "orange"

inputs:
  DEPENDENCY_FILES:
    description: A string params passed to Packj for auditing
    required: true
  FILES_EXIST:
    description: |
      A boolean indicating whether the dependency files exist in the repository. 
      Otherwise they should have been produced in intermediate steps
    required: false
    default: true
  REPO_TOKEN:
    description: Your repo GITHUB_TOKEN
    required: true

runs:
  using: "composite"

  steps:
    # 'save' the dependency files for later if they were generated in intermediate steps
    # otherwise they would be lost after the 'actions/checkout' step
    - name: Save intermediate files
      if: ${{ inputs.FILES_EXIST == 'false' }}
      shell: bash
      run: |
        input=$(echo "${{ inputs.DEPENDENCY_FILES }}" | sed 's/,/ /g')

        for item in $input
          do
            if [[ $item == *":"* ]]; then
              dep_file=$(echo $item | cut -f2 -d:)
              mv $dep_file $HOME/$dep_file
            fi
          done

    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
    - name: Check out repository code
      uses: actions/checkout@v3

    - name: Load intermediate files
      if: ${{ inputs.FILES_EXIST == 'false' }}
      shell: bash
      run: |
        input=$(echo "${{ inputs.DEPENDENCY_FILES }}" | sed 's/,/ /g')

        for item in $input
          do
            if [[ $item == *":"* ]]; then
              dep_file=$(echo $item | cut -f2 -d:)
              mv $HOME/$dep_file ./$dep_file
            fi
          done

    - name: Parse dependency files
      shell: bash
      run: |
        input=$(echo "${{ inputs.DEPENDENCY_FILES }}" | sed 's/,/ /g')

        echo "FILE_PATTERN<<EOF" >> $GITHUB_ENV

        for item in $input
          do
            if [[ $item == *":"* ]]; then
              pm_name=$(echo $item | cut -f1 -d:)
              dep_file=$(echo $item | cut -f2 -d:)

              path=${{ github.workspace }}/$dep_file
              if [ -f $path ]; then
                echo $dep_file >> $GITHUB_ENV
              fi
            fi
          done

        if [ ! -z input_files ]; then
          echo "EOF" >> $GITHUB_ENV
        fi

    - name: "Check for new changes in dependencies"
      if: ${{ inputs.FILES_EXIST == 'true' }}
      uses: brettcannon/check-for-changed-files@v1
      with:
        file-pattern: ${{ env.FILE_PATTERN }}
        failure-message: "No changes in ${ file-pattern }"

    - name: Clone Packj repo
      shell: bash
      run: git clone https://github.com/ossillate-inc/packj

    - name: Setup python & pip
      uses: actions/setup-python@v4
      with:
        python-version: "3.10"
        cache: pip

    - name: Create virtual environment
      shell: bash
      run: python3 -m venv venv

    - name: Activate virtual environment
      shell: bash
      run: source venv/bin/activate

    - name: Install Packj's dependencies
      shell: bash
      run: pip3 install -r ./packj/requirements.txt

    - name: Auditing deps with Packj
      shell: bash
      run: |
        input=$(echo "${{ inputs.DEPENDENCY_FILES }}" | sed 's/,/ /g') 
        input_files=()
        for item in $input
          do
            if [[ $item == *":"* ]]; then
              pm_name=$(echo $item | cut -f1 -d:)
              dep_file=$(echo $item | cut -f2 -d:)
              path=${{ github.workspace }}/$dep_file
              if [ -f $path ]; then
                input_files+=$pm_name":"$path,
              fi
            fi
          done
        if [ ! -z input_files ]; then
          input=$(echo $input_files | sed 's/,/ /g')
          cd packj
          python3 ./main.py audit -f $input
        fi

    - name: Analyze audit report
      shell: bash
      run: |
        echo "BODY<<EOF" >> $GITHUB_ENV
        if [ -f /tmp/packj_audit_*/*.html ]; then
          html_report=$(ls /tmp/packj_audit_*/*.html)
          cat $html_report | head -n -2 | tail -n +10 | sed 's/^[\s\t\r]*//g' >> $GITHUB_ENV
        else
          echo "<h4>Failed to perform Packj audit! Refer to workflow run for details</h4>" >> /$GITHUB_ENV
        fi
        run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
        commit_link="${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}"
        echo "Triggered by <a href=$run_url>workflow run ${{ github.run_number }}</a> on commit <a href=$commit_link>${{ github.sha }}</a>"  >> $GITHUB_ENV
        echo "EOF" >> $GITHUB_ENV
        echo "TITLE=Packj audit found risky dependencies!" >> $GITHUB_ENV

    # Create an issue for 'push'
    - name: create issue if ISSUE_REQUIRED is set
      if: ${{ github.head_ref == '' }}
      uses: rishabhgupta/git-action-issue@v2
      with:
        token: ${{ inputs.REPO_TOKEN }}
        title: ${{ env.TITLE }}
        body: ${{ env.BODY }}

    # Comment on the PR
    - name: Comment PR
      if: ${{ github.head_ref }}
      uses: thollander/actions-comment-pull-request@v2
      with:
        message: ${{ env.BODY }}