openvex-sync.yml

## %CopyrightBegin%
##
## SPDX-License-Identifier: Apache-2.0
##
## Copyright Ericsson AB 2024-2025. All Rights Reserved.
##
## Licensed under the Apache License, Version 2.0 (the "License");
## you may not use this file except in compliance with the License.
## You may obtain a copy of the License at
##
##     http://www.apache.org/licenses/LICENSE-2.0
##
## Unless required by applicable law or agreed to in writing, software
## distributed under the License is distributed on an "AS IS" BASIS,
## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
## See the License for the specific language governing permissions and
## limitations under the License.
##
## %CopyrightEnd%

## Periodically syncs OpenVEX files against Erlang OTP Securities,
## creating an automatic PR with the missing published securities.
name: OpenVEX Securities Syncing
description: 'Sync OpenVEX Securities with Erlang/OTP published Securities'

on:
  workflow_dispatch:
  schedule:
    - cron: 0 1 * * *

permissions:
  contents: read

jobs:
  run-scheduled-openvex-sync:
    runs-on: ubuntu-latest
    permissions:
      security-events: read
      actions: write
      contents: write
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: 'master' # '' = default branch

      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # v1
        with:
          otp-version: '28'

      - uses: openvex/setup-vexctl@e85ca48f3c8a376289f6476129d59cda82147e71 # ratchet:openvex/setup-vexctl@v0.1.1
        with:
          vexctl-release: '0.3.0'

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          # required
          app-id: ${{ vars.ERLANG_BOT_APP_ID }}
          private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}

      - name: Authenticate gh
        run: |
          echo "${{ steps.app-token.outputs.token }}" | gh auth login --with-token

      - name: Get GitHub App User ID
        id: get-user-id
        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

      - run: |
          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'

      - name: 'Open OpenVEX Pull Requests for newly released vulnerabilities'
        run: |
          .github/scripts/otp-compliance.es vex verify -p