setup.yaml

name: setup

on:
  workflow_dispatch:
  push:
    paths:
    - '.github/workflows/setup.yaml'
  
env:
  ULTRALYTICS_SOURCE: "CHAINGUARD"

permissions: {}

jobs:
  setup:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@df199fb7be9f65074067a9eb93f12bb4c5547cf2 # v2.13.3
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0
          ref: ${{ github.ref }}
        
      - name: Setup Git
        run: |
          git config --global user.email "gha@users.noreply.github.com"
          git config --global user.name "github-actions"

      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
        id: octo-sts
        with:
          scope: chainguard-dev/libraries-ultralytics-attack-demo
          identity: setup
      
      - name: Select analysis directory and populate src/ultralytics
        id: pick-dir
        run: |

          rm -rf src/ultralytics/*
          mkdir -p src/ultralytics/
      
          case "${ULTRALYTICS_SOURCE}" in
            CHAINGUARD)
              echo "Ultralytics src set to Chainguard Libraries"
              rsync -av --ignore-times vendor/ultralytics-before-attack/* src/ultralytics/
              rsync -av --ignore-times vendor/ultralytics-chainguard/* src/ultralytics/
              ;;
      
            PYPI)
              echo "Ultralytics src set to PYPI"
              rsync -av --ignore-times vendor/ultralytics-before-attack/* src/ultralytics/
              rsync -av --ignore-times vendor/malcontent-samples-ultralytics/v8.3.41/* src/ultralytics/
              ;;
      
            *)
              echo "❌ Unknown ULTRALYTICS_SOURCE value: '${ULTRALYTICS_SOURCE}'"
              echo "Valid values: PYPI, CHAINGUARD"
              exit 1
              ;;
          esac
      
          git add src/ultralytics/
          git commit --allow-empty -m "reset src/ultralytics"
          git push origin HEAD